Configuring the Blacklist/Whitelist to Block or Allow Internet Border Traffic

Scenario

After protection is enabled, CFW allows all traffic by default. You can configure the blacklist to block access requests from IP addresses or configure the whitelist to allow them. This section describes how to add a blacklist or whitelist item.

• Adding Blacklist Items to Block Internet Border Traffic
• Adding Whitelist Items to Allow Internet Border Traffic

Blacklist and Whitelist Rule Description

The protected objects, actions, and application scenarios of blacklist and whitelist rules are as follows.

Specification Limitations

• CFW supports a maximum of 2,000 blacklist and 2,000 whitelist items.
  • If the number of IP addresses to be added to the blacklist exceeds the upper limit, you can use the traffic blocking function to quickly block IP addresses. For details, see Quickly Blocking Malicious Traffic Through Traffic Blocking.
  • The whitelist is not the only way to control traffic. If you have too many IP addresses to manage, you can also create IP address groups and reference them in protection rules to allow their traffic. For details about how to add an IP address group, see Adding User-defined Address Groups.
• To protect private IP addresses, use the professional edition firewall and enable the VPC border firewall.

Impact on the System

• CFW directly allows whitelisted IP addresses and segments and blocks blacklisted ones without checking. To check the access and traffic statistics of these IP addresses, search for them by following the instructions in Log Query.
• When configuring a blacklist, if address translation or proxy is involved, evaluate the impact of blocking IP addresses with caution.

Adding Blacklist Items to Block Internet Border Traffic

1. Log in to the CFW console.
2. Click in the upper left corner of the management console and select a region or project.
3. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
4. In the navigation pane of the CFW console, choose Protection Policies > Access Control > Internet Border Protection Rules. The Internet Border Protection Rules page is displayed.
5. Click the Blacklist tab and click Add. On the Add to Blacklist page, configure the rule.

   Table 1 Internet border blacklist

   Parameter	Description
   Direction	You can select Source or Destination. Source: The party that initiates a session. Destination: The recipient of a session.
   Protocol Type	Its value can be TCP, UDP, ICMP, ICMPv6, or Any.
   Port	If Protocol Type is set to TCP or UDP, set the ports to be allowed or blocked. To specify all the ports of an IP address, set Port to 1-65535. You can specify a single port. For example, to allow or block the access from port 22 of an IP address, set Port to 22. To set a port range, use a hyphen (-) between the starting and ending ports. For example, to allow or block the access from ports 80-443 of an IP address, set Port to 80-443.
   IP Addresses	User-defined IP address: Enter one or more IP addresses in the text box and click Parse to add the IP addresses to the list. Pre-defined address group: Click Add Pre-defined IP Address Group. In the dialog box that is displayed, select an address group. For more information, see Viewing a Predefined Address Group. CAUTION: After WAF_Back-to-Source_IP_Addresses is added to the blacklist or whitelist, if a back-to-source IP address changes, you need to manually update it in the blacklist or whitelist.
   Description	(Optional) Enter remarks for the blacklist item.

6. Click OK.

   If the source addresses in the blacklist contain a WAF back-to-source IP address, enter CONFIRM in the displayed dialog box and click OK.

Adding Whitelist Items to Allow Internet Border Traffic

1. Log in to the CFW console.
2. Click in the upper left corner of the management console and select a region or project.
3. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
4. In the navigation pane of the CFW console, choose Protection Policies > Access Control > Internet Border Protection Rules. The Internet Border Protection Rules page is displayed.
5. Click the Whitelist tab and click Add. On the Add to Whitelist page, configure the rule.

   Table 2 Internet border whitelist

   Parameter	Description
   Direction	You can select Source or Destination. Source: The party that initiates a session. Destination: The recipient of a session.
   Protocol Type	Its value can be TCP, UDP, ICMP, ICMPv6, or Any.
   Port	If Protocol Type is set to TCP or UDP, set the ports to be allowed or blocked. To specify all the ports of an IP address, set Port to 1-65535. You can specify a single port. For example, to allow or block the access from port 22 of an IP address, set Port to 22. To set a port range, use a hyphen (-) between the starting and ending ports. For example, to allow or block the access from ports 80-443 of an IP address, set Port to 80-443.
   IP Addresses	User-defined IP address: Enter one or more IP addresses in the text box and click Parse to add the IP addresses to the list. Pre-defined address group: Click Add Pre-defined IP Address Group. In the dialog box that is displayed, select an address group. For more information, see Viewing a Predefined Address Group. CAUTION: After WAF_Back-to-Source_IP_Addresses is added to the blacklist or whitelist, if a back-to-source IP address changes, you need to manually update it in the blacklist or whitelist.
   Description	(Optional) Enter remarks for the whitelist item.

6. Click OK.

References

• For details about how to edit and remove blacklist or whitelist items, see Managing the Blacklist and the Whitelist.
• For details about how to add blacklist or whitelist items in batches, see Importing and Exporting Protection Policies.
• For details about how to quickly import a large number of blacklist items, see Quickly Blocking Malicious Traffic Through Traffic Blocking.
• For details about how to add refined access control rules, see Configuring Internet Border Protection Rules.
• For details about how to block malicious attacks, see Attack Defense.