All Products
Search
Document Center

Cloud Firewall:Create an access control policy for a NAT firewall

更新時間:Jul 30, 2024

If you want to manage outbound traffic from resources such as an Elastic Compute Service (ECS) instance or elastic container instance in a virtual private cloud (VPC) to the Internet over a NAT gateway, you can enable a NAT firewall for the NAT gateway and configure an access control policy to perform fine-grained management on traffic from internal-facing resources to the Internet.

When internal-facing resources in a VPC directly access the Internet over a NAT gateway, risks such as unauthorized access, data leaks, and traffic attacks may occur. You can create a NAT firewall to allow only the required traffic by specifying items such as the source address, destination address, port, protocol, and application. This effectively restricts unauthorized access from internal-facing resources to the Internet.

After you enable a NAT firewall for a NAT gateway, the NAT firewall manages all outbound traffic from the internal-facing resources in a VPC to the NAT gateway. The resources include resources that are deployed in the same VPC and resources across VPCs.

Prerequisites

  • A NAT firewall is created and enabled. For more information, see NAT firewalls.

  • The quota for access control policies is sufficient. You can view the quota for access control policies on the Prevention Configuration > Access Control > NAT Border page. For more information about how to calculate quota usage, see Overview of access control policies.

    If the quota is insufficient, you can click Increase Quota to increase the value of Quota for Additional Policy. For more information, see Purchase Cloud Firewall.

    image..png

  • If you want to specify multiple items as source or destination addresses, you can create an address book. For more information, see Manage address books.

Procedure

  1. Log on to the Cloud Firewall console.

  2. In the left-side navigation pane, choose Prevention Configuration > Access Control > NAT Border.

  3. On the NAT Border page, find the NAT gateway for which you want to create an access control policy and click Create Policy.

    The NAT gateways within the current Alibaba Cloud account are automatically synchronized to Cloud Firewall.

    image..png

  4. In the Create Policy - NAT Border panel, configure the following parameters and click OK.

    Parameter

    Description

    Source Type

    The initiator of network traffic. You must select a source type and enter source addresses from which network traffic is initiated based on the selected source type.

    • If you set Source Type to IP, specify one or more CIDR blocks, such as 192.168.0.0/16. You can specify up to 2,000 CIDR blocks. Separate multiple CIDR blocks with commas (,).

      If you enter multiple CIDR blocks at a time, Cloud Firewall automatically creates an address book that includes the entered CIDR blocks. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book.

    • If you set Source Type to Address Book, make sure that an IP address book is configured. For more information about how to create an address book, see Manage address books.

    Source

    Destination Type

    The receiver of network traffic. You must select a destination type and enter destination addresses to which network traffic is sent based on the selected destination type.

    • If you set Source Type to IP, specify one or more CIDR blocks, such as 192.168.0.0/16. You can specify up to 2,000 CIDR blocks. Separate multiple CIDR blocks with commas (,).

      If you enter multiple CIDR blocks at a time, Cloud Firewall automatically creates an address book that includes the entered CIDR blocks. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book.

    • If you set Source Type to Address Book, make sure that an IP address book is configured. For more information about how to create an address book, see Manage address books.

    • If you set Destination Type to Domain Name, select a domain name identification mode. Valid values:

      • FQDN-based Dynamic Resolution (Extract Host and SNI Fields): If you want to manage HTTP, HTTPS, SMTP, SMTPS, and SSL traffic, we recommend that you select this mode.

      • DNS-based Dynamic Resolution: If you want to manage traffic except HTTP, HTTPS, SMTP, SMTPS, and SSL traffic, we recommend that you select this mode.

        Important

        This mode does not support wildcard domain names.

      • FQDN and DNS-based Dynamic Resolution (Support for HTTP, HTTPS, SSL, SMTP, and STMPS): If you want to manage HTTP, HTTPS, SMTP, SMTPS, and SSL traffic, but specific or all traffic does not contain the HOST or SNI field, we recommend that you use this mode.

      • Important

        This mode takes effect only if the ACL Engine Management mode is Strict.

    • If you set Destination Type to Region, select one or more locations of traffic destinations for Destination. You can select one or more locations in or outside China.

    Destination

    Protocol Type

    The transport layer protocol. Valid values: TCP, UDP, ICMP, and ANY. If you do not know the protocol type, select ANY.

    Port Type

    The port type and port number of the destination.

    • If you set Port Type to Port, enter port ranges. Specify a port range in the Port number/Port number format. Examples: 22/22 or 80/88. Separate multiple port ranges with commas (,). You can enter up to 2,000 port ranges.

      If you enter multiple port ranges, Cloud Firewall automatically creates an address book that includes the entered port ranges. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book.

    • If you set Port Type to Address Book, make sure that a port address book is configured. For more information about how to create an address book, see Manage address books.

    Port

    Application

    The application type of the traffic.

    • If you set the Domain Name Identification Mode parameter to DNS-based Dynamic Resolution, you can select all applications.

    • If you set the Domain Name Identification Mode parameter to FQDN-based Dynamic Resolution (Extract Host and SNI Fields), you can select only HTTP, HTTPS, SMTP, SMTPS, or SSL.

    • If you set the Domain Name Identification Mode parameter to FQDN and DNS-based Dynamic Resolution, you can select HTTP, HTTPS, SMTP, SMTPS, or SSL.

    Action

    The action on the traffic if the traffic meets the preceding conditions that you specify for the access control policy. Valid values:

    • Allow: The traffic is allowed.

    • Deny: The traffic is denied, and no notifications are sent.

    • Monitor: The traffic is recorded and allowed. You can observe the traffic for a period of time and change the policy action to Allow or Deny based on your business requirements.

    Description

    The description of the access control policy. Enter a description that can help identify the policy.

    Priority

    The priority of the access control policy. Default value: Lowest. Valid values:

    • Highest: The access control policy has the highest priority.

    • Lowest: The access control policy has the lowest priority.

    Policy Validity Period

    The validity period of the access control policy. The policy can be used to match traffic only within the validity period.

    Status

    Specifies whether to enable the policy. If you turn off Status when you create an access control policy, you can enable the policy in the list of access control policies.

Configure the access control engine mode

After an access control policy is created, the access control engine mode of the NAT firewall is Loose Mode by default. In this mode, the traffic whose application type or domain name is identified as Unknown is automatically allowed to avoid impacts on your workloads. You can change the mode to Strict Mode based on your business requirements.

  1. On the Prevention Configuration > Access Control > NAT Border page, click ACL Engine Management in the upper-right corner of the access control policy list.

  2. In the ACL Engine Management - NAT Firewall panel, find the NAT gateway whose engine mode you want to change and click Modify in the Engine Mode column.

  3. In the Change Engine Mode dialog box, configure the Engine Mode parameter and click OK.

    • Strict Mode: After you enable the strict mode, the traffic whose application type or domain name is identified as Unknown is matched against all policies that you configured. If you configured a Deny policy, this type of traffic is denied.

    • Loose Mode: After you enable the loose mode, traffic whose application type or domain name is identified as Unknown is allowed. This ensures normal access.

View the hit details about an access control policy

After your service runs for a period of time, you can view the hit details about an access control policy in the Hits/Last Hit At column in the list of access control policies.

You can click the number of hits to go to the Log Audit page to view traffic logs. For more information, see Log audit.

image.png

Related operations

After you create an access control policy, you can click Modify, Delete, or Copy in the Actions column of the policy. You can also click Move to change the priority of the policy. After you change the priority of the policy, the priorities of access control policies that have lower priorities decrease.

Important

After you delete a policy, Cloud Firewall no longer manages traffic on which the policy is originally in effect. Proceed with caution.

References