Diagram of the Web Application Firewall traffic flow
Web Application Firewall (WAF) sits between clients and your backend servers as a reverse proxy, inspecting all inbound traffic before it reaches your origin infrastructure.
WAF acts as a reverse proxy between clients and your backend servers. All inbound requests pass through WAF first — clients interact only with WAF, not directly with your origin infrastructure.
The following diagram shows the traffic flow.
WAF IP addresses are allocated in the cloud. You can monitor traffic to the WAF virtual IP address (VIP) using Banff. The WAF VIP is backed by an LVS cluster and operates similarly to an SLB VIP. Both the WAF VIP and the IP addresses of the backend WAF engines are visible on VNET.
The client sends a request to the WAF VIP.
The WAF VIP routes the request to a backend WAF engine (Server A) in the LVS cluster.
-
Server A performs Layer 7 inspection to determine whether the request is normal or malicious.
If the request is normal, Server A forwards it to the source server.
If the request is malicious, Server A blocks it and returns a response directly to the client.
-
The source server processes the forwarded request and returns a response to Server A.
NoteServer A plays a different role in steps 3 and 4:
To the client, Server A acts as the server.
To the source server, Server A acts as the client.
Server A returns the response to the client through the LVS IP address.