Docs

Cloud Firewall

Protection settings

Internet Border Firewall Policy

The cloud firewall helps you protect the communication traffic between internet and public IP assets; you can configure inbound rules to reduce the exposure of public assets and lower the risk of intrusion, and configure outbound rules to effectively intercept unauthorized access from the internal network to the public network. This article describes how to configure access control policies for the internet border.

Requirements

Before configuring the internet border firewall policy, please ensure that the internet border firewall switch is turned on; otherwise, the policy will not take effect. For more details, please refer to Internet Border Firewall.

Usage Limits

There are the following limits on the number of internet border firewall access control policies:

Advanced version default: 4,000 rules;

Enterprise version default: 10,000 rules;

Flagship version default: 20,000 rules; \nIf the remaining available policy authorization specifications are insufficient, you can click Instance Management - System Settings to scale up.

Create Access Control Policy

In the left navigation bar, select Access Control ＞ Internet Boundary

In the Inbound Rules/Outbound Rules tab, you can add inbound rules and outbound rules separately.

Configuration item	Configuration description	Configuration Parameter Examples
Rule priority	Select the priority of this policy, here selecting the highest priority. After configuration is complete, you can also click move in the access control policy list to customize the adjustment of the policy priority. Highest priority: Refers to the highest priority for access control policy to take effect first. Lowest priority: Refers to the lowest priority for access control policy to take effect last.	Highest priority
Access source type	You need to select the access source type and enter the access source address based on the access source type. When selecting IP type, you need to enter an IP address or IP address range. For example, 180.184.1.1 or 180.184.0.0/16, 0.0.0.0/0 indicates all. When selecting Address Book type, you need to create an IP address book in advance. When selecting the region type, the inbound rules can choose the region where the source address is located. You can choose domestic regions or international regions.	IP
Access source			0.0.0.0/0
Access purpose type	You need to select the access purpose type and input the access destination address according to the access purpose type. When selecting IP type, you need to enter the IP address or IP address range. Such as 180.184.1.1 or 180.184.0.0/16, 0.0.0.0/0 represents all. When selecting address book type, you need to create an IP address book or domain name address book in advance. When selecting domain name type for outbound rules, you can enter the destination domain name address. Inputting a domain name supports entering a single domain name example.com, wildcard domain *.example.com, multi-level domain example1.example2.com. warning Please do not input protocols like http(s) etc. The principle of empty policy for domain name access is to obtain domain data for matching control based on the Host information in the HTTP protocol data and the Server Name information in the Client Hello of the HTTPS protocol data packet. If your business traffic data packet does not include these two fields, the domain policy will not take effect. When selecting Region type, the outbound rules can choose the region where the source address is located. You can choose domestic or international regions.	IP
Access purpose			180.100.1.1/32
Protocol Type	Specifies the transport layer protocol type. Supported options include: TCP UDP ICMP ANY If you are unsure about the specific protocol, select ANY.	TCP
Destination port type	Set the destination port type and destination port. This selection of the address book requires configuration for ports 80 and 443. When selecting port type, you need to enter a port or a range of ports, such as 22, 80/88, 0/65535. Address book: When selecting address book type, you need to create a port address book in advance.	Address book
Destination port			Web service port address book
Action	Set the release status of traffic that matches successfully in this policy. Release: Release this traffic, and record the release log in the access control log; traffic log will be recorded in the traffic session. Block: Intercept this traffic, and a block log will be recorded in the access control log. Observe: Release this traffic. The observation log will be recorded in the access control log. After observing for a period of time, you can adjust it to allow or deny as needed.	Release
Policy effective time	Always valid: Once the policy is configured, it will always be valid. Repeat effective: the policy can be effective multiple times within a certain time range, such as from 2024-12-01 to 10:00 2025-12-01 10:00, repeating every Monday from 10:00 to 11:00. Single time period effective: the policy can be effective within a certain time range, such as from 2024-12-01 to 10:00 2024-12-08 10:00. tip The interval between the start time and end time of the policy must be greater than 30 minutes.	Always effective
Description	Enter the current policy content and usage scenarios. This helps you identify and apply access control policies.	Web service 80&443 port release policy
Policy switch	Set the Policy switch. If you did not enable the policy when creating it, you can enable the policy in the policy list.	Keep it enabled

View Access Control Policy

After the configuration of the policy is complete, you can view the latest hit time and hit count of the current policy in the access control policy list.

You can go to the access control policy list to copy the current policy ID, and search for that policy ID in log management to view the access control logs.

Related Operations

After the access control policy has been created, you can perform the following operations on the policy list.

Retrieve: Supports searching by access source, access destination, destination port, rule ID, and rule description, and supports multiple selections.

Edit: Supports editing the policy and modifying the policy parameters.

Move: Supports custom prioritization of the policy.

Copy: Supports copying this policy for quickly adding similar policies for business purposes.

Delete: After deleting the policy, the traffic controlled by this policy will not be subject to the access control of the cloud firewall. Please delete with caution.