NAT Firewall

Protection mechanism

NAT Firewall provides features such as one-click activation, asset synchronization, access control policy configuration for the NAT boundary, traffic analysis, and log audit.

After you enable the NAT Firewall, it inspects all outbound traffic from private network resources in your VPC (including resources in the same VPC and across different VPCs) that passes through the associated Internet NAT Gateway. The NAT Firewall evaluates traffic against configured access control policies and the built-in Cloud Firewall threat intelligence database. It matches traffic elements such as source and destination addresses, ports, protocols, applications, and domains to determine whether to allow the traffic. This restricts unauthorized access from your private network to the internet.

Traffic redirection mechanism

When you enable the NAT Firewall, Cloud Firewall automatically modifies the route table to redirect all outbound traffic that uses the Internet NAT Gateway to Cloud Firewall for security inspection.

Traffic path before enabling NAT Firewall

Traffic path after enabling NAT Firewall

When you enable the NAT Firewall, Cloud Firewall automatically creates corresponding firewall interface elastic network interfaces (ENIs) based on the EIPs associated with the original Internet NAT Gateway. For example, if the Internet NAT Gateway is associated with two EIPs, Cloud Firewall creates one inbound ENI (eni0) and two outbound ENIs (eni1 and eni2).

When you enable the NAT Firewall, Cloud Firewall automatically performs the following routing configurations to inspect and protect outbound traffic from your private network assets:

1. Creates a firewall vSwitch: This vSwitch carries the redirected traffic, guiding it from your private assets to the internet through Cloud Firewall.

2. Creates a custom route table and associates it with the firewall vSwitch: Cloud Firewall automatically creates a custom route table named Cloud_Firewall_ROUTE_TABLE. It then adds a static route with the destination 0.0.0.0/0 and the next hop pointing to the Internet NAT Gateway. This ensures that traffic processed by Cloud Firewall is correctly routed back to the Internet NAT Gateway.

3. Adds SNAT entries: Cloud Firewall adds ENI-specific SNAT entries to the Internet NAT Gateway. The source ENI is set to the firewall's outbound ENIs (such as eni1 and eni2). This ensures that outbound traffic processed by the firewall can correctly undergo source address translation.

4. Modifies the system route table: The next hop of the default route (0.0.0.0/0) in the system route table is changed from the Internet NAT Gateway to the Cloud Firewall inbound ENI (eni0).

These routing configurations redirect all outbound traffic that uses the Internet NAT Gateway to Cloud Firewall. Cloud Firewall then performs Layer 4 to Layer 7 security inspection on the traffic, including access control, threat intelligence matching, and basic defense.

Impact on your services

When you enable or disable the NAT Firewall, Cloud Firewall performs a route switch. This causes a transient disconnection of 1 to 2 seconds for long-lived connections. Short-lived connections are not affected. To minimize the impact on your services, we recommend performing these operations during off-peak hours.

• Creating a NAT Firewall does not affect your services. However, if you choose to enable the firewall during creation, it will cause a transient disconnection of 1 to 2 seconds for long-lived connections. Short-lived connections are not affected.

  Note

  The time it takes to create a NAT Firewall depends on the number of EIPs associated with the Internet NAT Gateway. Each additional EIP increases the creation time by approximately 2 to 5 minutes. This process does not affect your services.

• Disabling and then deleting a NAT Firewall does not affect your services.

• If your traffic exceeds the throughput limit of your Cloud Firewall subscription, the service-level agreement (SLA) is not guaranteed. This may trigger service degradation, such as the failure of security features (access control, IPS, log audit), the firewall being disabled for assets that generate excessive traffic, or rate limiting and packet loss.

  If your traffic might exceed the limit, we recommend you refer to Pay-as-you-go for burstable traffic of subscription instances.

Limitations

• After you enable the NAT Firewall, do not change the routes in the firewall's vSwitch or any route whose next hop is the NAT Firewall. Modifying these routes can cause service disruptions.

• To add a new CIDR block for cross-VPC protection after enabling the NAT Firewall, you must manually update the route table of the firewall's vSwitch. We also recommend you update the corresponding route in the route table that was used before the firewall was enabled. This prevents routing issues if the firewall is later disabled.

• If your Cloud Firewall subscription expires and is not renewed in time, the NAT Firewall is automatically released. Traffic then reverts to the original outbound internet route, which may cause a brief service interruption.

  To ensure service availability, we recommend that you enable auto-renewal or renew your subscription in advance. For more information, see Renewal.

• For NAT Firewalls created before September 1, 2023, the maximum protection bandwidth for all network connections to the same destination IP and port pair is 20 Mbps. If the bandwidth for these connections exceeds 20 Mbps, you may experience network jitter. To increase this bandwidth limit, we recommend you delete and recreate the NAT Firewall.

  NAT Firewalls created on or after September 1, 2023, do not have this 20 Mbps bandwidth limit. Their protection bandwidth can reach up to 4 Gbps.

• NAT Firewall does not protect IPv6 traffic.

• NAT Firewall does not support Intrusion Prevention System (IPS) capabilities.

• Creating a NAT Firewall automatically adds new SNAT entries. The number of new SNAT entries equals the number of EIPs associated with the Internet NAT Gateway. Do not delete or modify the SNAT entries created by Cloud Firewall.

• For information about the limits on SNAT entries, see NAT Gateway quotas. Ensure you reserve enough SNAT capacity for the NAT Firewall. The number of reserved SNAT entries must equal the number of EIPs associated with the Internet NAT Gateway.

Workflow

The following flowchart shows the process of using a NAT Firewall.

Notes

• It takes 1 to 5 minutes for a new Internet NAT Gateway to synchronize with the NAT Firewall service.

• New EIPs and SNAT entries for an Internet NAT Gateway take 1 to 2 minutes to be synchronized to the NAT Firewall. These resources become effective only after synchronization is complete.

  Alternatively, you can go to the Firewall > Internet Firewall page and click Synchronize Assets to manually synchronize the EIPs and SNAT entries.

• A new route that points to an Internet NAT Gateway takes up to 30 minutes to be synchronized to the NAT Firewall.

  Alternatively, you can go to the Firewall > NAT Firewall page and click Synchronize Assets to manually synchronize the route.

• When you create a NAT Firewall, Cloud Firewall performs the following actions:

  • Adds a 0.0.0.0/0 route that points to the Internet NAT Gateway in the route table of the firewall's vSwitch.

  • Modifies the 0.0.0.0/0 route entry in the system route table to change its next hop to a Cloud Firewall ENI.

  Note

  Creating a NAT Firewall adds a custom route table to your VPC. If the VPC where you are creating the firewall contains an ACK cluster that uses the Flannel network plugin, you must configure the multi-route-table feature of the Cloud Controller Manager after the firewall is created. Add the VPC system route table to the list of route tables. If you do not perform this step, cluster node scaling may be affected. For more information, see Use the multi-route-table feature of a VPC.

  If you are already using the multi-route-table feature of the Cloud Controller Manager, you can ignore this note.

Procedure

1. Log on to the Cloud Firewall console. In the left-side navigation pane, click Firewall.

2. Click the NAT Firewall tab. In the Actions column for the target Internet NAT Gateway, click Create.

3. In the Create NAT Firewall panel, click Check Now. After all checks pass, click Next.

   If you are sure that the Internet NAT Gateway meets all requirements, you can click Skip and start creation now.

4. Select a traffic redirection mode:

   • Automatically Create vSwitch (Recommended): This mode provides fully automated traffic redirection and is suitable for environments with ample network segments.

   • Manually Select vSwitch: This mode requires you to reuse an existing vSwitch CIDR block or manually create a vSwitch. It is suitable for environments with limited network segments and should be performed by an experienced user.

5. In the Create NAT Firewall panel, configure the following parameters.

   Parameter		Description
   Basic Information	Name	Enter a custom name for the NAT Firewall.
   Traffic Redirection Configurations	Select Route Table	Select the route table where the Internet NAT Gateway is the current next hop. When the firewall is created, the next hop is automatically changed to a Cloud Firewall ENI. This directs outbound traffic from your private assets to the NAT Firewall.
   	vSwitch CIDR block (Automatically Create vSwitch) or vSwitch for traffic redirection (Manually Select vSwitch)	You can create a new vSwitch or select an existing one. Rules for configuring a new vSwitch: You must configure a vSwitch CIDR block with at least a /28 mask that does not conflict with your network plan. This is allocated to the NAT Firewall for traffic redirection. The vSwitch CIDR block must be a subnet of the VPC's CIDR block and must not conflict with existing service network segments. Secondary CIDR blocks are supported. After allocation, Cloud Firewall automatically associates the vSwitch with a custom traffic redirection route table. Notes for selecting an existing vSwitch: The NAT Firewall requires a vSwitch that meets the following requirements. For more information, see Create and manage a VPC. The vSwitch, Internet NAT Gateway, and NAT Firewall must be in the same VPC. The vSwitch and the Internet NAT Gateway must be in the same availability zone. The vSwitch CIDR block must have at least a /28 mask, and the number of available IP addresses must exceed the number of EIPs on the Internet NAT Gateway. The vSwitch must not be connected to any other cloud resources. Create a new route table and associate it with the vSwitch. For more information, see Create and manage a route table. (Optional) Add custom route entries other than the 0.0.0.0/0 route to the new route table as needed. For more information, see Use custom route tables to manage network traffic. For example, if your services require cross-VPC communication, you must manually add the return routes for the VPCs to the route table. Note If the target vSwitch does not appear in the list or is grayed out, check whether the vSwitch is associated with other cloud resources or a custom route table. After you confirm that the vSwitch configuration is correct, go to the NAT Firewall tab and click Synchronize Assets in the upper-right corner.
   Engine Mode	Engine Mode	The matching mode for access control policies. Loose Mode (Default): In this mode, if an access control policy for applications or domains encounters traffic from an unidentified application or domain, the traffic is allowed. This mode prioritizes service availability. Strict Mode: In this mode, if an access control policy for applications or domains encounters traffic from an unidentified application or domain, the traffic is passed to subsequent policies for further matching. If a deny policy matches the unidentified traffic, the traffic is blocked.

6. Select I have read and confirmed the preceding notes, and then click Enable Firewall.

7. After the NAT Firewall is created, you need to manually set the Enabled Status to On.

   After you enable the firewall, Cloud Firewall reroutes the traffic for protection.

Configure access control policies

If you do not configure any access control policies, Cloud Firewall allows all traffic by default. You can create access control policies for the NAT Firewall to gain fine-grained control over outbound internet traffic from your private assets.

Go to the Firewall > NAT Firewall page. In the Actions column for the target NAT Firewall, click the icon and select Access Control.

On the page that appears, you can create an access control policy for the NAT Firewall. For more information, see Configure an access control policy for a NAT Firewall.

Query audit logs

Go to the Firewall > NAT Firewall page. In the Actions column for the target NAT Firewall, click the icon and select Log Audit.

On the page that appears, you can query traffic logs for private network access to the internet. For more information, see Log audit.

View traffic analysis

Go to the Firewall > NAT Firewall page. In the Actions column for the target NAT Firewall, click the icon and select Analysis.

The page that appears shows a traffic analysis of the Internet NAT Gateway's internet access. For more information, see Outbound connections.

View NAT private network traffic statistics

In the left-side navigation pane, click Overview. On the Overview page, click Purchased Specification Usage in the upper-right corner. Here, you can view NAT private network traffic capacity, recent peak traffic, and NAT Firewall license usage.

View NAT Firewall vSwitch list

Go to the Firewall > NAT Firewall page. In the upper-right corner of the NAT Firewall list, click Firewall vSwitch List.