All Products
Search

This Product

    Cloud Firewall:Configure access control policies to allow traffic from an internal-facing server only to a specific domain name

    Document Center

    Cloud Firewall:Configure access control policies to allow traffic from an internal-facing server only to a specific domain name

    Last Updated:Apr 09, 2024

    If you want to manage traffic from internal-facing assets to the Internet in a fine-grained manner, you can configure access control policies for NAT firewalls to block unauthorized access from the internal-facing assets to the Internet. This helps reduce risks such as data leaks in your core business. This topic describes how to configure access control policies for a NAT firewall to allow traffic from an internal-facing asset only to a specific website.

    Example scenario

    In this example, your asset is an internal-facing Elastic Compute Service (ECS) instance whose private IP address is 10.10.XX.XX. The ECS instance accesses the Internet over an Internet-facing NAT gateway. To ensure the security of the ECS instance, you must configure access control policies to allow traffic from the ECS instance only to the website www.aliyun.com.

    image

    Procedure

    1. Log on to the Cloud Firewall console.

    2. In the left-side navigation pane, choose Access Control > NAT Border

    3. On the NAT Border page, find the NAT gateway for which you want to create an access control policy and click Create Policy.

      The NAT gateways within the current Alibaba Cloud account are automatically synchronized to Cloud Firewall.

      image..png

    4. In the Create Policy - NAT Border panel, configure an access control policy that allows traffic from the ECS instance to www.aliyun.com and has the highest priority and an access control policy that denies traffic from the ECS instance to all public IP addresses and has the lowest priority.

      1. Configure the access control policy that allows traffic from the ECS instance to www.aliyun.com. The following table describes the parameters.

        Parameter

        Description

        Example

        Source Type

        The initiator of network traffic. You must select a source type and enter source addresses from which network traffic is initiated based on the selected source type.

        IP

        Source

        10.10.XX.XX/32, which is the private IP address of the ECS instance

        Destination Type

        The receiver of network traffic. You must select a destination type and enter destination addresses to which network traffic is sent based on the selected destination type.

        Domain Name, and set the Domain Name Identification Mode parameter to FQDN-based Dynamic Resolution (Extract Host and SNI Fields).

        Destination

        www.aliyun.com, which is the website that you allow the ECS instance to access

        Note

        You can also resolve the domain name into an IP address.

        Protocol Type

        The transport layer protocol. Valid values: TCP, UDP, ICMP, and ANY. If you do not know the protocol type, select ANY.

        TCP

        Port Type

        The port type and port number of the destination.

        Port

        Port

        0/0, which indicates all ports

        Application

        The application type of the traffic. Valid values:

        • If you set the Domain Name Identification Mode parameter to DNS-based Dynamic Resolution, you can select all applications.

        • If you set the Domain Name Identification Mode parameter to FQDN-based Dynamic Resolution (Extract Host and SNI Fields), you can select only HTTP, HTTPS, SMTP, SMTPS, or SSL.

        • If you set the Domain Name Identification Mode parameter to FQDN and DNS-based Dynamic Resolution, you can select only HTTP, HTTPS, SMTP, SMTPS, SSL, or ANY.

        HTTPS

        Action

        The action on the traffic if the traffic meets the preceding conditions that you specify for the access control policy. Valid values:

        • Allow: The traffic is allowed.

        • Deny: The traffic is denied, and no notifications are sent.

        • Monitor: The traffic is recorded and allowed. You can observe the traffic for a period of time and change the policy action to Allow or Deny based on your business requirements.

        Allow

        Priority

        The priority of the access control policy. Default value:Lowest. Valid values:

        • Highest: The access control policy has the highest priority.

        • Lowest: The access control policy has the lowest priority.

        Highest

        Policy Validity Period

        The validity period of the access control policy. The policy can be used to match traffic only during the validity period.

        Always

        Status

        Specifies whether to enable the policy. If you turn off Status when you create an access control policy, you can enable the policy in the list of access control policies.

        Enabled

      2. Configure the access control policy to deny traffic from the ECS instance to all public IP addresses. The following list describes the parameters.

        • Source: Enter 10.10.X.X/32.

        • Destination: Enter 0.0.0.0/0, which indicates the IP addresses of all servers.

        • Protocol Type: Select ANY.

        • Port: Enter 0/0, which indicates all ports of servers.

        • Application: Select ANY.

        • Action: Select Deny.

        • Priority: Select Lowest.

      After you create the access control policies, make sure that the priority of the policy that allows traffic from the ECS instance to www.aliyun.com is higher than the priority of the policy that denies traffic from the ECS instance to all public IP addresses.

    What to do next

    References