Docs

Web Application Firewall

CNAME association

Allow access from the back-to-origin CIDR blocks

After your business connects to the Web Application Firewall, all requests will be forwarded to the origin server through the firewall's back-to-origin IP addresses. Since requests are concentrated on these back-to-origin IPs, it may lead to security policy misjudgments at the origin server, triggering unnecessary interceptions or rate limiting. If your origin server is already configured with a firewall or security software, it is recommended that you first obtain the list of back-to-origin IP addresses from the Web Application Firewall, and then add these IPs to the following allowlist of the origin server to ensure that normal requests from the Web Application Firewall are not mistakenly intercepted by the origin server's security policies.

Background information

Before connection

When not connected to the Web Application Firewall, your business requests typically come from dispersed client IP addresses. This dispersion allows the origin server's firewall or security software to accurately identify normal traffic, preventing misjudgments that could lead to interceptions or rate limiting.

After connection

Once the business connects to the Web Application Firewall, all requests will be concentrated and forwarded to the origin server through the firewall's fixed back-to-origin IP addresses. This traffic aggregation feature may lead to a significant increase in the number of requests handled by each back-to-origin IP, and the firewall or security software at the origin may mistakenly identify the high-frequency access back-to-origin IP as a potential threat, triggering the origin's security policies, resulting in normal requests being intercepted or throttled. To avoid this situation, it is recommended to add the back-to-origin IP of the Web Application Firewall to the allowlist of the origin's security facilities to ensure that normal business traffic is not affected.

Steps

When accessing the domain name, the Web Application Firewall will display the corresponding back-to-origin IP address after the configuration parameters are submitted. This section describes how to view the back-to-origin IP address on the website settings page.

Select the instance region in the top bar.

On the left-side navigation pane, select Website settings.

Filter the domain names associated via CNAME.

Click the corresponding domain name in the list to view domain details.

On the website details page, obtain the back-to-origin IP.

Go to the security software on the origin server and add all the back-to-origin IP addresses shown in the image above to the allowlist.

What to do next

After allowing the returning source IP, you need to confirm whether the forwarding rules are effective to ensure that business traffic can be properly forwarded through the Web Application Firewall. For details, please refer to Verify the forwarding configuration.

Last updated: 2025.06.30 16:22:21