Docs

Web Application Firewall

Best practices

Joint deployment of DDoS native protection and Web Application Firewall

BytePlus Web Application Firewall provides application layer protection for your website, such as identifying and blocking SQL injection, cross-site scripting attacks (XSS), CC attacks, and more. In addition, the Web Application Firewall can be used in conjunction with DDoS native protection to defend against Layer 4 DDoS attacks such as UDP Flood and SYN Flood. This article describes how to jointly deploy WAF services and DDoS native protection to achieve more comprehensive security protection.

Deployment architecture

All request traffic is first inspected and scrubbed by DDoS native protection to intercept network layer and transport layer attacks, such as SYN Flood and UDP Flood.

Scrubbed traffic is forwarded to the WAF, where the WAF performs deep inspection to identify and block SQL injection, CC attacks, malicious crawler scans, and other web application layer attacks.

Filtered legitimate traffic is forwarded to the origin server, where the origin server processes and responds to business requests.

Solution advantages

Layered protection mechanism

The Web Application Firewall focuses on application layer security protection and can detect and intercept attacks targeting web applications, while DDoS native protection focuses on Layer 4 attack defense, effectively resisting high-volume DDoS attacks and safeguarding the stability of network infrastructure. The two complement each other in protection capabilities, helping your business effectively respond to different types of attacks and enhancing overall security protection.

One-click quick configuration

Cloud WAF instances support rapid integration with DDoS native protection. Simply add the EIP of the cloud WAF instance to the DDoS native protection instance to quickly enable protection. The entire deployment process is simple and efficient, requiring no adjustment to business architecture or modification of proxy configuration, reducing the complexity of deployment and maintenance.

Hide origin server IP

After DDoS native protection is bound to the cloud WAF instance, client requests are forwarded to your origin server via the WAF origin IP. Users will directly access the IP of the WAF node rather than the origin server IP, effectively protecting the security of your origin server.

Hybrid cloud protection

DDoS native protection only supports the protection of public cloud assets within the cloud. However, by integrating the protection capabilities of cloud WAF, this solution can be applied to assets outside the cloud or in multi-cloud scenarios. Cloud WAF can forward traffic to origin servers outside the cloud, while DDoS native protection focuses on protecting the proxy IP of cloud WAF. This architecture enables assets outside the cloud to benefit from dual protection by DDoS native protection and WAF.

Comparison of advanced edition and enterprise edition of DDoS native protection

After binding DDoS native protection with WAF, native protection will protect the EIP corresponding to the WAF instance. The advanced and enterprise editions of DDoS native protection differ in the type of EIP they protect, so the procedures also vary. The following is a comparison:

Item	DDoS native protection (Advanced Edition) + Cloud WAF	DDoS native protection (Enterprise Edition) + cloud WAF
Protected EIP type	Standard EIP	Enhanced EIP
Impact of instance expiration	Expiration of DDoS native protection (Advanced Edition): The associated standard EIP will no longer have DDoS native protection capabilities, but will retain WAF protection capabilities. Expiration of WAF instance: The associated standard EIP will be disassociated and will no longer have DDoS native protection or WAF protection capabilities.	Expiration of DDoS native protection (Enterprise Edition): The associated enhanced public IP will be disassociated and will no longer have DDoS native protection or WAF protection capabilities. Expiration of WAF instance: The associated enhanced EIP will be disassociated and will no longer have DDoS native protection or WAF protection capabilities.
WAF binding method	Scenario 1: Add a Cloud WAF instance to DDoS native protection (Advanced Edition) for protection	Scenario 2: Add a cloud WAF instance to DDoS native protection Enterprise Edition for protection

Caution

The DDoS native protection instance and cloud WAF instance to be bound must be in the same region.

Only website services that are connected to cloud WAF instances via CNAME are supported for protection.

Scenario 1 Add cloud WAF instance to DDoS native protection advanced edition for protection

DDoS native protection advanced edition supports the protection of standard EIPs, and a standard EIP is created by default when a cloud WAF instance is provisioned. Therefore, in this case, you can bind them in either the DDoS native protection console or the WAF console.

Requirements

You have purchased a DDoS native protection advanced edition instance. For details, see Purchase advanced edition of native protection.

You have purchased a cloud WAF instance. For details, see Purchase cloud WAF instance.

Your website service has already been connected to the cloud WAF instance via CNAME. For details, see Connect to cloud WAF instance via CNAME.

Operation steps

One-click WAF protection in the DDoS native protection console

Select the region of the instance to be connected in the top menu bar.

warning

This region must be the same as the region of the cloud WAF instance.

On the left side of the page, select DDoS native protection>Protection resources.

At the top of the list, select the target DDoS native protection (advanced edition) instance.

Click Add protected EIP.

Filter by Web Application Firewall resource type and select the target instance.

Click Confirm.

After the addition is complete, your WAF instance will benefit from the full protection capabilities of the DDoS native protection instance. When your service is subjected to a DDoS attack, the system will automatically trigger traffic scrubbing, effectively defending against DDoS attacks.

Enable DDoS protection with one click in the Web Application Firewall console

If the domain to be protected has not yet been added to the cloud WAF instance you created, you can associate the required native protection instance when configuring the website access parameters. For specific steps, refer to Accessing the cloud WAF instance via CNAME.

If you have already completed the access configuration for the domain to be protected before binding, but have not yet associated a DDoS native protection instance, you can go to the website configuration list to perform the binding operation.

This section describes how to enable DDoS native protection for protected websites that have already been connected to a cloud WAF instance.

Select the region of the instance to be accessed from the top menu bar.

warning

This region must be the same as the region of the DDoS native protection instance.

In the left navigation pane, select Website settings.

Filter websites accessed via CNAME, select the target website, and choose More > Access DDoS native protection.

Select the DDoS native protection Advanced Edition instance, and click Access protection.

warning

After connecting the protected website to the corresponding DDoS native protection instance, all websites protected by the associated cloud WAF instance will receive security protection from the native protection service.

Scenario 2 Add the cloud WAF instance to DDoS native protection Enterprise Edition for protection

DDoS native protection Enterprise Edition supports Enhanced EIP protection, while the cloud WAF instance creates a Standard EIP by default when enabled. Therefore, in this case, the protection resource list in the DDoS native protection console cannot display the corresponding cloud WAF resources, and you need to perform the binding operation through the WAF console.

Caution

If you previously configured and enabled a cloud firewall protection policy for a WAF-associated EIP instance, after enabling DDoS native protection (Enterprise Edition), the WAF's EIP will be replaced by the enhanced protection EIP protected by DDoS native protection (Enterprise Edition). At this point, the WAF instance will no longer be protected by the existing cloud firewall protection policy. To re-enable cloud firewall protection, please reconfigure.

Requirements

You have purchased a DDoS native protection Enterprise Edition instance. For details, see Purchase native protection Enterprise Edition.

You have purchased a cloud WAF instance. For details, see Purchase a cloud WAF instance.

Your website has already been connected to the cloud WAF instance via CNAME. For details, see Connect to a cloud WAF instance via CNAME.

Procedure

If the domain to be protected has not yet been added to the cloud WAF instance you created, you can associate the required native protection instance when configuring the website access parameters. For specific steps, see Connect to a cloud WAF instance via CNAME.

If you have already completed the access configuration for the domain to be protected before binding, but have not yet associated a DDoS native protection instance, you can go to the website configuration list to perform the binding operation.

This section describes how to enable DDoS native protection for a protected website that has already been connected to a cloud WAF instance.

In the top menu bar, select the region where the connected instance is located.

warning

This region must be the same as the region of the DDoS native protection instance.

In the left navigation pane, select Website settings.

Filter websites accessed via CNAME, select the target website, and choose More > Access DDoS native protection.

Select the DDoS native protection Enterprise Edition instance and click Access protection.

warning

Last updated: 2025.12.05 18:55:41