Internet firewall-Cloud Firewall(Cloud Firewall)-阿里云帮助中心

We recommend that you enable the internet firewall for all your public assets to mitigate threats from network attacks, reduce your internet exposure, and minimize security risks for your business traffic. You can enable this feature with a single click, and protection takes effect within seconds without changing your business routes. Enabling protection is a prerequisite for using Cloud Firewall. Configurations for modules such as the intrusion prevention system (IPS), access control policies, traffic analysis, and log auditing take effect only after an asset is protected.

Scope

The internet firewall protects both outbound and inbound traffic for public IPv4 and IPv6 assets within your account. To protect assets in other accounts, you must complete enterprise certification and configure unified multi-account management.

Supported asset types

IPv4 assets: AI Gateway public IP address, ALB EIP, API Gateway public IP address, Bastionhost outbound IP address, Bastionhost IP address, Bastionhost inbound IP address, EIP, Wuying Workspace (Enterprise Edition) public IP address, ECS EIP, ECS public IP address, ENI EIP, GA EIP, HAVIP, NAT EIP, NAT Gateway public IP address, NLB EIP, Server Load Balancer (SLB) EIP, SLB public IP address, Simple Application Server public IP address, and VPN Gateway public IP address.
IPv6 assets: AI Gateway public IPv6 address, ALB IPv6, API Gateway public IPv6 address, ECS IPv6, ENI EIP IPv6, GA EIP IPv6, NLB IPv6, and Server Load Balancer (SLB) IPv6.

Note

For GA EIPs and GA EIP IPv6s, the following conditions must be met:

The GA instance to which the accelerated IP addresses belong must be a standard GA instance.
The accelerated IP addresses must be of the EIP type.
The acceleration region to which the accelerated IP addresses belong cannot be an Alibaba Cloud point of presence (POP).
To check whether an acceleration region is a POP of Alibaba Cloud, call the ListAvailableBusiRegions operation.

Impact on services

You can enable internet firewall protection for an asset in seconds with a single click and without changing your network topology.

Routing and network architecture: No route modifications are required.
Risk of false positives:
- intrusion prevention system (IPS): By default, the threat engine runs in Deny - Medium mode, which is suitable for daily security protection scenarios with a low false-positive rate. If your business is highly sensitive to traffic continuity, you can first set the threat engine mode to Monitor and adjust it later as needed. For more information about the configuration, see IPS configuration.
- access control policy: By default, all rule actions are set to Allow, which eliminates the risk of incorrect blocking but provides no protection. After you enable protection, we recommend that you adjust your policies as needed. For more information, see Access control policy overview.

Protection specifications

Starting October 15, 2025, Cloud Firewall will introduce Billing method 2.0. New users will default to Billing method 2.0, while existing users will continue to use Billing method 1.0. The protection specifications for the internet firewall differ between the two billing methods.

Billing method 2.0

With Billing method 2.0, billing is based on the number of firewall instances and the processed public traffic.

Number of firewall instances: Each protected region corresponds to one instance. Within the same region, only one instance is consumed, regardless of the number of protected public IP addresses or whether the IP addresses are IPv4 or IPv6.
Public traffic processing capability: Billing is based on the peak of total processed public traffic, which is the sum of your inbound and outbound bandwidth.

subscription: Each edition provides a specific number of firewall instances and a specific public traffic processing capability. If your quota is insufficient, you can upgrade your plan. If your actual traffic exceeds the purchased processing capability, the excess traffic is billed on a pay-as-you-go basis.

pay-as-you-go: You are billed based on the actual number of firewall instances and the peak of total processed traffic. The maximum supported peak bandwidth is 10 Gbps. To request a higher limit, contact your account manager or architect.

Billing method 1.0

With Billing method 1.0, billing is based on the number of protected public IP addresses and the processed public traffic.

Number of protectable public IP addresses: The number of public IP addresses that you can protect with the internet firewall.
Public traffic processing capability: Billing is based on the peak of total processed public traffic, which is the higher of your inbound or outbound bandwidth.

subscription: Each edition provides a specific quota for protectable public IP addresses and a specific public traffic processing capability. If your quota is insufficient, you can upgrade your plan. If your actual traffic exceeds the purchased processing capability, the excess traffic is billed on a pay-as-you-go basis.

pay-as-you-go: You are billed based on the actual number of protected public IP addresses and the peak of total processed traffic.

Enable protection for assets

When you activate Cloud Firewall, if you set the Auto Protection for Internet Assets option to Yes, the system automatically enables protection for all public assets in your account, and you can skip the following manual steps. If you set it to No, you must manually enable protection by following these steps:

Log on to the Cloud Firewall console. In the left-side navigation pane, click Firewall.
On the Internet Firewall tab, click the IPv4 or IPv6 tab based on the IP address type of your assets.
If the target asset is not displayed in the public asset list, click Synchronize Assets in the upper-right corner of the list. The synchronization takes about 1 to 2 minutes.
Enable protection in one of the following ways:
- For a single asset: In the row of the target asset, click Enable Protection in the Actions column.
- For multiple assets: Select the checkboxes of the target assets, and then click Enable Protection below the list.

Configure automatic protection for new assets

After you enable Automatic Protection for New Assets, the system automatically enables internet firewall protection for any new public assets added to your Alibaba Cloud account and its member accounts, if multi-account management is configured. We recommend enabling this feature to ensure timely protection for your public assets.

When you activate Cloud Firewall: Use the Auto Protection for Internet Assets option to manage this setting.
After you activate Cloud Firewall: In the Cloud Firewall console, navigate to the Firewall > Internet Firewall page and use the Automatic Protection for New Assets toggle switch in the upper-right corner to manage the setting.
- Select asset types for automatic protection: Click Automatic Protection for New Assets. In the configuration panel that appears, select the new asset types and their regions to be automatically protected. After you complete the configuration, click Save to apply the changes.

Next steps

When you enable internet firewall protection for an asset, the system applies default protection rules. To avoid incorrect blocking, the default policies are permissive and offer limited protection. We recommend that you optimize your protection settings as follows:

Adjust the IPS threat engine mode: The engine runs in Deny - Medium mode by default, which is suitable for daily security scenarios and has a low false-positive rate. You can switch to a more permissive or stricter mode based on your business requirements. For configuration details, see IPS configuration.
Configure access control policies: By default, all rule actions are set to Allow, which provides no actual protection. We recommend that you adjust these policies as needed. The best practice is to adopt an allowlist model, which drops all traffic by default and allows only known, trusted traffic. To prevent incorrect blocking, avoid applying strict rules directly. We recommend starting with the Monitor action. After monitoring your traffic for a period to ensure stability, you can gradually change the action to Drop. For configuration details, see Configure an access control policy for the internet firewall.

After you configure the policies, you can view traffic and protection logs in the following ways:

Outbound traffic: On the Analysis > Outbound Connections page, view traffic data for outbound connections from your business assets to the internet. For more information, see Outbound Connection.
Inbound traffic: On the Analysis > Internet Exposure page, view data about internet traffic that accesses your business assets. For more information, see Internet Exposure.
Intrusion prevention events: On the Firewall > Internet Firewall page, locate the target asset and click View Attacks in the Actions column. You can view attack data for the asset's inbound or outbound traffic. For more information, see Intrusion Prevention.
Detailed log auditing: Navigate to Detection & Response > Log Audit > Flow Logs > Traffic Logs. On the Internet Border tab, set filter conditions to view detailed access logs between your public assets and the internet. For more information, see Log Auditing.

Routine operations

On the Firewall > Internet Firewall tab, you can perform the following operations:

View asset protection status: The information bar at the top of the page displays the number of firewall instances and protected public IP addresses. You can click Enable All to protect all assets with one click, or click View Details for specific asset information. If the number of Available Quotas is insufficient, click Upgrade to increase your capacity.
Download public asset information: You can download the public asset list as a CSV file. In the upper-right corner of the public asset list, click the icon. Then, click Download Task Management in the upper-right corner of the page to check the download progress. After the task is complete, click Download in the Actions column to download the file.
Disable internet firewall protection for an asset: After you disable protection, Cloud Firewall no longer manages the asset's traffic. This may expose the asset to risks such as malicious attacks and data breaches. Proceed with caution. On the Internet Firewall tab, click the IPv4 or IPv6 tab. In the public asset list, find the target asset and click Disable in the Actions column.

Apply default allow policies to security groups

After you enable internet firewall protection for an ECS asset, you can apply a default policy to the associated ECS basic security group for inbound traffic with a single click. This feature centralizes public traffic control under Cloud Firewall for unified auditing and management, eliminating the need to configure security groups in the ECS console.

Scope

This feature supports only basic security groups that are associated with ECS public IP addresses or EIPs. It does not support enterprise security groups.

Policy logic

The system automatically adds four rules with a priority of 100 (the lowest) to the target security group. The logic is as follows:

Explicitly allow public traffic: An 0.0.0.0/0 Allow rule is added. This rule overrides any default deny configurations, which ensures that public traffic passes through the security group to be filtered by Cloud Firewall.
Block direct private network access: Deny rules are added to block traffic from 192.168.0.0/16, 172.16.0.0/12, and 10.0.0.0/8. This prevents east-west traffic within the internal network from bypassing Cloud Firewall and accessing the instance directly.
Deny takes precedence: According to the security group matching mechanism, for rules with the same priority, Deny rules take precedence over Allow rules. If a Deny rule with a priority of 100 already exists in the security group, the newly applied Allow policy does not override it, thus preserving your original security baseline.

Rule details

Source	Protocol Type	Port Range	Policy Type	Description
192.168.0.0/16	ALL	-1/-1	Deny	Blocks RFC 1918 private network traffic to prevent internal traffic from bypassing protection.
172.16.0.0/12	ALL	-1/-1	Deny
10.0.0.0/8	ALL	-1/-1	Deny
0.0.0.0/0	ALL	-1/-1	Allow	A catch-all rule to route public traffic to Cloud Firewall for management.

Important

Risk of public exposure: Before you apply these policies, ensure that all ECS assets are protected by the internet firewall and have effective access control policies configured. Otherwise, applying these policies may allow public traffic to pass directly to your instances, creating an exposure risk.
Limitation for unmanaged resources: Do not apply these policies to resources that are not protected by the internet firewall. Doing so will block private network traffic and leave public traffic unmanaged by the security group, because it would not be protected by Cloud Firewall.
Residual rules after service release: If you release the Cloud Firewall service, these four rules are not automatically removed. You must manually delete them to avoid conflicts with future network planning and security policy deployments.

Procedure

Log on to the Cloud Firewall console. In the left-side navigation pane, click Firewall.
On the Internet Firewall tab, click the IPv4 tab.
In the public asset list, locate the target ECS asset and click Apply in the Default Allow Policies column.
(Optional) Resolve policy conflicts.
- Automatically adjustable conflicts: If an existing rule in the security group has the same priority as a rule to be applied, but a different protocol type, port range, or source, you can click Quick Modify in the dialog box. The system automatically increases the priority of the original rule to resolve the conflict.
- Conflicts that require manual adjustment: If an existing rule has the same priority, protocol type, port range, and source as a rule to be applied, you must manually adjust rule priorities on the security group page in the ECS console. For more information, see Modify a security group rule.
In the dialog box, click Quick Apply. Review the four policies to be applied, and then click OK.
If an ECS instance is associated with multiple security groups, you must apply the policies to all of them for the default allow policy to take effect.

After the configuration is complete, you can check the application status on the Firewall > Internet Firewall page.

Status	Description
Applied	The default allow policies are applied to all security groups associated with the ECS asset.
Not Applied	The default allow policies are not applied to some or all of the associated security groups, or a configuration conflict exists.
-	One-click application of default allow policies is not supported for this asset type.

FAQ

Access control policy not effective or logs missing

If an access control policy configured for a public asset, such as a NAT EIP or an ECS instance, does not take effect, or if the traffic logs do not contain the expected records, the cause is typically that the asset's Firewall Status on the internet firewall tab is Unprotected. In this state, policies are not enforced, and traffic is neither blocked nor recorded.

Solution:

Log on to the Cloud Firewall console.
In the left-side navigation pane, click Firewall.
On the Internet Firewall tab, check the protection status of the target public asset.
If the Firewall Status is Unprotected, manually enable protection.

After protection is enabled, the asset's traffic is managed by the configured access control policies (for example, to allow or drop traffic), and all actions are recorded in the traffic logs.