Configure DNS border access control policies

Limitations

Only the Enterprise Edition and Ultimate Edition of Cloud Firewall support DNS access control policies. The Enterprise Edition supports up to 10,000 policies, and the Ultimate Edition supports up to 20,000 policies. To increase your policy quota, contact your account manager.

Create a policy to allow specific domains

1. Log on to the Cloud Firewall console.

2. In the left-side navigation pane, choose Prevention Configuration > Access Control > Policy Configuration > DNS Border.

3. On the DNS Border page, click Create Policy.

4. This section provides an example of creating a DNS access control policy that allows only traffic from trusted source IP addresses to access a specific domain.

   1. In the Create Policy dialog box, configure an Allow policy for trusted source IP addresses based on the following table.

      Parameter	Description
      Source Type	The origin of the network traffic. Select a source type and enter the corresponding address. For this example, specify the IP address of the asset in your VPC. If you select the IP type, enter a CIDR block, such as 192.168.0.0/16. Each policy supports only one CIDR block. If you select the address book type, you must first create an IP address book. For instructions, see Address books. Note You can select only one address book at a time. To use multiple address books, you can create additional policies.
      Source
      Destination Type	The destination type and address for the traffic. For this example, specify an internet domain name. If you select the Domain type, enter the destination domain name. You can use wildcard domain names, such as *.aliyun.com. If you select the address book type, you must first create a domain address book. For instructions, see Address books. Note You can select only one address book at a time. To use multiple address books, you can create additional policies.
      Destination
      Action	The action to take on traffic that matches the policy. Allow: allows the traffic. Deny: blocks the traffic and does not send a notification. Monitor: In this mode, traffic is allowed by default. You can filter and observe this traffic using the relevant fields in traffic logs. After a period of observation, you can change the action to Allow or Deny as needed.
      Description	Enter a description for the policy. This helps you identify the policy's purpose.
      Priority	The priority of the policy. A smaller number indicates a higher priority, with 1 being the highest. If multiple policies have the same priority, the policy with the Deny action takes precedence. Note DNS access control policy priorities are static. You can assign the same priority number to multiple policies. Therefore, we recommend planning your policy priorities in advance.

   2. Create a second access control policy to deny all other traffic to the specified domain.

      • Source: Set to 0.0.0.0/0.

      • Action: Set to Deny to block all unauthorized access.

      • Priority: Ensure this policy has a lower priority (a higher number) than the first Allow policy for the trusted source.

      • For other parameters, refer to the configuration table above.

Export policies

You can export your DNS access control policies. On the DNS Border page, click the icon above the policy list to export them.

After the export is complete, click DNS Border in the upper-right corner of the Download Task Management page to view the task status and download the file to your local computer.

View policy hits

After you create an access control policy, it takes effect immediately by default. You can view its hits in the Hit Count and Last Hit Time columns of the policy list.

Values in the Hit Count and Last Hit Time columns indicate that traffic has matched the policy. You can click the hit count to view detailed data on the Log Audit page. For more information, see Log Audit.

Related operations

After you create a policy, you can modify, delete, or copy it from the access control policy list.