Configure NAT Border access control policy
To control the outbound internet traffic from resources in your Virtual Private Cloud (VPC), such as ECS and Elastic Container Instance (ECI) instances, you can enable a NAT firewall for your NAT gateway. By configuring an access control policy, you can precisely manage how your private resources connect to the internet.
When private resources in a VPC access the internet directly through a NAT gateway, they are exposed to risks such as unauthorized access, data leaks, and malicious traffic attacks. You can use the NAT firewall feature of Cloud Firewall to allow only necessary traffic by specifying criteria such as source, destination, port, protocol, and application. This effectively limits unauthorized internet access from your private resources.
After you enable the NAT firewall for a NAT gateway, it protects all outbound traffic that flows from private resources within the VPC to that NAT gateway. This includes resources in the same VPC and across different VPCs.
Prerequisites
-
You have created and enabled a NAT firewall. For more information, see NAT firewall.
-
You have a sufficient quota for access control policies. You can check your policy usage on the page. For information about how policy quota is calculated, see Overview of access control policies.
If your available quota is insufficient, you can click Increase Quota to purchase an Quota for Additional Policy. For more information, see Purchase Cloud Firewall.
-
To use multiple IP addresses or domains as a source or destination, create an address book first. For more information, see Address books.
Configure an access control policy
-
Log on to the Cloud Firewall console.
-
In the left-side navigation pane, select .
-
On the NAT Border page, select the NAT gateway to configure, and Click Create Policy.
Cloud Firewall automatically synchronizes the NAT gateways associated with your current account, You can select the NAT gateway to configure from the drop-down list.
-
On the Create Policy - NAT Border panel, configure the access control policy, and click OK.
Configuration item
Description
Source Type
The source of network traffic. You need to select the access source type and enter the address based on the type.
-
Select the IP type and enter an IP address range. Address ranges must use the standard CIDR format, such as 192.168.0.0/16.You can enter up to 2,000 address ranges separated by commas (,).
If you enter multiple IP address ranges, Cloud Firewall automatically creates an address book and prompts you to set a name when you save the policy.
-
Select Address Book type, and reference Custom IP Address Book or Cloud Asset IP Address Book.For more information, see Manage address books.
Destination Type
The destination of network traffic. You need to select the destination type and enter the address based on the type.
-
Select the IP type and enter an IP address range. Address ranges must use the standard CIDR format, such as 192.168.0.0/16.You can enter up to 2,000 address ranges separated by commas (,).
If you enter multiple IP address ranges, Cloud Firewall automatically creates an address book and prompts you to set a name when you save the policy.
-
Select Address Book type, and reference IP Address Book and Domain Address Book.For more information, see Manage address books.
-
When you select the Domain Name type, you need to select the domain name recognition mode. Three domain name recognition modes are available:
-
FQDN-based Resolution (Extract Host or SNI Field in Packets): We recommend this mode when managing traffic of the following seven protocols: HTTP, HTTPS, SMTP, SMTPS, SSL, POPS, and IMAPS.
-
DNS-based Dynamic Resolution: We recommend this mode when managing traffic other than the seven protocols: HTTP, HTTPS, SMTP, SMTPS, SSL, POPS, and IMAPS.
ImportantThis mode does not support wildcard domains or wildcard domain address books.
-
at the same time based on FQDN and DNS dynamic resolution: We recommend this mode when managing traffic of the seven protocols, but some or all traffic does not carry the HOST/SNI field.
ImportantThis mode takes effect only when ACL Engine Management strict mode is enabled, and does not support wildcard domains or wildcard domain address books.
-
-
Select Location type, select the Destination address where the region. You can select China region or international region.
Protocol
Transport layer protocol type. Supported settings: TCP, UDP, ICMP, ANY. If you are unsure of the specific protocol, you can select ANY.
Port Type
-
Select Port type, enter port range. Port ranges are separated by forward slashes (/), such as 22/22 and 80/88.You can add up to 2,000 port ranges, separated by commas (,).
If you enter multiple port ranges, Cloud Firewall automatically creates a port address book and prompts you to set a name when you save the policy.
-
When you select the Port Address Book type, you need to create a port address book in advance. For more information, see Manage address books.
Application
-
Protocol When you select TCP:
-
Destination Type Select IP, IP Address Book or Location: You can select all applications.
-
Destination Type Select Domain Name ordomain name Address Book:
-
Domain Name Identification Mode When you select FQDN-based Resolution (Extract Host or SNI Field in Packets), you can only select applications such as HTTP, HTTPS, SMTP, SMTPS, SSL, POPS, and IMAPS.
-
Domain Name Identification Mode When you select DNS-based Dynamic Resolution, you can select all applications.
-
Domain Name Identification Mode When you select Based on both FQDN (extract Host/SNI from packets) and DNS dynamic resolution, you can only select applications such as HTTP, HTTPS, SMTP, SMTPS, SSL, POPS, and IMAPS.
-
-
-
When you select UDP Protocol, the application type supports ANY and DNS.
-
When you select ICMP or ANY Protocol, the application type can only be ANY.
Action
Specify the action for matched traffic in this policy.
-
Allow: Allow the traffic.
-
Drop: Block the traffic without any notification.
-
Monitor: In this mode, traffic is allowed by default. You can filter and observe this traffic by using relevant fields in Traffic Logs, After a period of observation, adjust to Allow or Deny.
Policy Priority
Policy priority. Default value: Lowest, indicating the lowest priority.
-
Highest: The access control policy takes effect with the highest priority.
-
Lowest: The access control policy takes effect with the lowest priority.
-
Custom: Customize the priority. Minimum: 1, Maximum: 50. The smaller the number, the higher the priority.
Policy Validity Period
Set the validity period of the policy. The policy can match traffic only within the validity period.
-
Always
-
Single Time Range: Select a one-time time period.
-
Recurrence Cycle: Select a recurring time period and effective dates.
Note-
The start time of the effective date must be earlier than the end time. The policy takes 3 to 5 minutes to take effect.
-
If you select Indefinite Recurrence, the effective end time is automatically set to December 31, 2099.
-
Related FAQ: Does a policy take effect if the recurrence cycle spans multiple days?
-
Status
Specify whether to enable the policy. Only enabled policies take effect.
Description
Enter a description for the policy to help you identify its purpose.
-
Configure ACL engine mode
After you configure access control policies, the ACL engine for the NAT firewall defaults to Loose Mode. In this mode, traffic from unidentified applications or domain names is allowed by default to prevent service disruptions. You can switch to Strict Mode as needed.
-
On the page, click ACL Engine Management in the upper-right corner of the policy list.
-
In the ACL Engine Management - NAT Firewall panel, find the NAT gateway for which you want to change the mode, and then click Modify in the Engine Mode column.
-
In the Change Engine Mode dialog box, select an engine mode, and then click OK.
-
Strict Mode: Unidentified application or domain name traffic is matched against your access control policies. If this traffic matches a Deny policy, it is blocked.
-
Loose Mode: Unidentified application or domain name traffic is allowed to ensure business continuity.
-
View policy hit statistics
After your business has been running for a period, you can view the hit count of access control policies in the Hits/Last Hit At column in the access control policy list.
Click the hit count to go to the Traffic Logs page to view traffic logs. For information about how to view traffic logs, see Traffic Logs.
Related operations
After you create a policy, you can edit, delete, copy, or move it from the policy list. Moving a policy changes its priority. When a policy's priority changes, the priorities of all lower-priority policies are adjusted accordingly.
After you delete a policy, the traffic it managed is no longer controlled by Cloud Firewall. Proceed with caution.
Related documents
-
To control traffic from private resources to specific websites, see Tutorial: Configure a policy to allow a private server to access only a specific domain name.
-
To learn how access control policies work, see Overview of access control policies.
-
For more examples of how to configure access control policies, see Configuration examples for access control policies.
-
To view and manage address books for IP addresses, ports, and domain names, see Address books.
-
For answers to common questions about configuring and using access control policies, see FAQ about access control policies.