If you created a Network Load Balancer (NLB) instance and added a TCP listener to the instance, you can add the listener ports to Web Application Firewall (WAF) to redirect the web traffic of the instance to WAF for protection. This topic describes how to enable WAF protection for an NLB instance.
Background information
NLB is a Layer 4 load balancing service intended for the Internet of Everything (IoE) era. NLB offers ultra-high performance and can automatically scale on demand. An NLB instance supports up to 100 million concurrent connections and is suitable for services that require high concurrency. For more information about NLB, see What is NLB?
You can add an NLB instance to WAF for protection. After you add an NLB instance to WAF, all web traffic of the instance is redirected to WAF for inspection by using a specific gateway. WAF filters out malicious traffic and forwards normal traffic to the NLB instance. The following figure shows the network architecture.
Limits
Web services that use one of the following Alibaba Cloud services can be added to WAF in cloud native mode: Application Load Balancer (ALB), Microservices Engine (MSE), Function Compute, Classic Load Balancer (CLB), Elastic Compute Service (ECS), and Network Load Balancer (NLB).. If you want to use WAF to protect web services that do not use the preceding Alibaba Cloud services, add the domain names of the web services to WAF in CNAME record mode. For more information, see Add a domain name to WAF.
Item | Description |
Supported instances | You can add only an instance that meets the following requirements to WAF:
|
Supported regions |
|
Number of traffic redirection ports | The maximum number of traffic redirection ports is the same as the maximum number of protected objects.
|
Port settings |
|
Prerequisites
A WAF 3.0 instance is purchased. For more information, see Purchase a subscription WAF 3.0 instance and Purchase a pay-as-you-go WAF 3.0 instance.
An NLB instance is created, and a TCP listener is added to the NLB instance. The instance also meets the preceding requirements. For more information about the requirements, see Limits. For more information about how to add a TCP listener to an NLB instance, see Add a TCP listener.
If you use a subscription WAF instance, make sure that the number of protected objects that you added to WAF does not exceed the upper limit. If the number exceeds the upper limit, you can no longer add cloud service instances to WAF.
To view the number of protected objects that you can add to WAF, go to the Protected Objects page.
Add traffic redirection ports
When you add an instance to WAF, your web services may be interrupted for several seconds. If clients can be automatically reconnected, the web services automatically resume. Configure reconnection mechanisms and back-to-origin settings based on your business requirements.
If you perform the following operations after you add a Layer 4 CLB, ECS, or NLB instance to WAF, traffic redirection ports are automatically removed from WAF. If you do not re-add the ports to WAF, traffic on the ports is not filtered by WAF.
Change the public IP address associated with the instance.
NoteIf the public IP address of the NLB instance changes, traffic redirection is not disabled.
Enable mutual authentication.
Remove the listener ports from the instance.
Delete the instance.
Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region of the WAF instance. You can select Chinese Mainland or Outside Chinese Mainland.
In the left-side navigation pane, click Website Configuration.
On the Cloud Native tab, click NLB in the left-side cloud service list.
On the authorization page, click Authorize Now to authorize your WAF instance to access the required cloud service.
Alibaba Cloud automatically creates the AliyunServiceRoleForWAF service-linked role. To view the service-linked role, log on to the Resource Access Management (RAM) console and choose in the left-side navigation pane.
NoteIf the authorization is complete, the authorization page is not displayed. You can proceed to the next step.
Click Add.
In the Configure Instance - NLB panel, configure the parameters. The following table describes the parameters.
Parameter
Operation
Select the instance and port to be added.
Optional: Synchronize Instances
If the instance that you want to add to WAF is not in the instance list, click Synchronize Instances to refresh the instance list.
Add Port
Find the instance that you want to add to WAF and click Add Port in the Actions column.
Select the port that you want to add to WAF.
Configure the Protocol Type parameter for the port that you want to add to WAF. Valid values: HTTP and HTTPS.
If you select HTTPS, you must upload a certificate.
NoteThe total number of default and additional certificates that you upload cannot exceed 10.
Default Certificate
If you select HTTPS, you can click Advanced Settings to configure the following advanced parameters:
Whether Layer 7 Proxy, Such as Anti-DDoS Pro, Anti-DDoS Premium, or Alibaba Cloud CDN, Is Deployed in Front of WAF
Specify whether a Layer 7 proxy, such as Anti-DDoS Proxy or Alibaba Cloud CDN, is deployed in front of WAF.
By default, No is selected. This value specifies that WAF receives requests that are sent from clients. The requests are not forwarded by proxies.
NoteWhen a request is sent from a client to WAF, WAF uses the IP address that is used to establish the connection to WAF as the IP address of the client. The IP address is specified by the
REMOTE_ADDR
field of the request.If a Layer 7 proxy is deployed in front of WAF, select Yes. This value specifies that WAF receives requests that are forwarded to WAF by a Layer 7 proxy. To ensure that WAF can obtain the actual IP addresses of clients for security analysis, you must configure the Obtain Actual IP Address of Client parameter.
Resource Group
Select the resource group to which you want to add the instance. If you do not select a resource group, the instance is added to the default resource group.
NoteYou can use Resource Management to create resource groups and manage resources within your Alibaba Cloud account by department or project. For more information, see Create a resource group.
Advanced Settings
Select the instance that you want to add to WAF and click OK.
After you add an instance to WAF, the instance becomes a protected object of WAF. The name of the protected object is in the Instance ID-Port-Asset type format. By default, protection rules of the core protection rule module are enabled for the protected object. You can view the protected object and configure protection rules for the protected object on the Protected Objects page. To go to the page, click the ID of the instance on the Cloud Native tab of the Website Configuration page. For more information, see Protection configuration overview.
Other operations
View origin servers and manage traffic redirection ports
After you add an instance to WAF, you can view the protection details of the origin servers and forcefully disable traffic redirection or remove traffic redirection ports in emergency disaster recovery scenarios.
On the Website Configuration page, click the Cloud Native tab.
Click NLB in the left-side cloud service list. Find the NLB instance that you want to manage and click the icon to the left of the instance name to view the traffic redirection ports that are added to WAF.
View port details: Click Port Details in the Actions column to view port details, including the port, protocol, and certificate. You can reconfigure the following parameters: Whether Layer 7 Proxy, Such as Anti-DDoS Pro, Anti-DDoS Premium, or Alibaba Cloud CDN, Is Deployed in Front of WAF, Enable Traffic Mark, and Back-to-origin Keep-alive Requests. You can click Advanced Settings to find the Enable Traffic Mark and Back-to-origin Keep-alive Requests parameters.
Remove a port: Find the port and click Remove. In the Remove message, click OK.
ImportantWhen you remove a traffic redirection port from WAF, your web services may be interrupted for several seconds. If clients can be automatically reconnected, the web services automatically resume. Configure reconnection mechanisms and back-to-origin settings based on your business requirements.
After you remove a traffic redirection port from WAF, traffic on the port is no longer protected by WAF. To re-add the port to WAF, click Add. For more information, see Add traffic redirection ports.
Update a certificate associated with a traffic redirection port
If a certificate that is associated with a traffic redirection port is about to expire or the certificate is changed, such as when the certificate is revoked, you must update the certificate.
If the remaining validity period of the certificate is less than 30 days, the icon is displayed in the domain name list. This indicates that your certificate is about to expire. In this case, you must update the certificate at the earliest opportunity.
If you want to receive notifications by using methods such as email or text message when the certificate is about to expire, you can configure notifications for the certificate. For more information, see Configure notifications for SSL certificates.
To prevent service interruptions due to certificate expiration, enable the certificate hosting feature of Certificate Management Service. If you enable this feature for a certificate, the system automatically applies for a new certificate when the hosted certificate is about to expire. For more information, see Introduction to the certificate hosting feature.
Perform the following steps:
Renew the certificate or upload a third-party certificate to Certificate Management Service. For more information, see Certificate renewal or Upload and share an SSL certificate.
Synchronize the certificate to WAF.
Update the certificate in the WAF console.
On the Cloud Native tab, click NLB in the left-side cloud service list. Find the instance that you want to manage and click the icon. Find the traffic redirection port whose certificate you want to update and click Modify in the Actions column.
In the Default Certificate section, click Select Existing Certificate and select the new certificate from the drop-down list.