Overview-Web Application Firewall(WAF)-阿里云帮助中心

This topic describes the three WAF 3.0 connection methods: cloud native mode, CNAME connection, and Hybrid Cloud WAF connection. It covers the working principles and setup procedures for each method to help you choose the most suitable option for your web services.

Connection method comparison

Item	Cloud native mode	CNAME connection	Hybrid Cloud WAF connection
Item	Cloud native mode	CNAME connection	Reverse proxy	SDK integration
Use cases	Quickly connect Alibaba Cloud product instances within the same account. Supports scenarios with domain names or only public IP addresses.	Protects services identified by a domain name. This is a versatile method that supports cross-account and multicloud scenarios.	You want to deploy WAF locally for protection. You want to protect internal services. Your service has a moderate traffic volume.	You want to deploy WAF locally for protection. You have a unified ingress gateway, such as Nginx or APISIX. Your service has high traffic volume and requires minimal latency and maximum stability.
Protected object	Alibaba Cloud product instance	domain name	Domain name or IP address	Domain name or IP address
Limitations	If the multi-account management feature is not configured, you can connect only cloud product instances within your account. Some cloud product instances in specific regions are not supported. You cannot connect to private or IPv6 instances of Elastic Compute Service (ECS), Classic Load Balancer (CLB), or Network Load Balancer (NLB). You can connect only instances of Application Load Balancer (ALB), Classic Load Balancer (CLB), Elastic Compute Service (ECS), Network Load Balancer (NLB), Function Compute (FC), Microservices Engine (MSE), and cloud-native API gateway (APIG).	You must verify domain name ownership, modify DNS records, and allow back-to-origin IP addresses. You must have permissions to manage the DNS records of the domain name.	You must subscribe to the WAF Enterprise or Ultimate edition and purchase Additional Hybrid Cloud Protection Nodes. You must have permissions to manage the DNS records of the domain name.	You must subscribe to the WAF Enterprise or Ultimate edition and purchase Additional Hybrid Cloud Protection Nodes. You must have a unified ingress gateway and the ability to manage it independently.

The supported security features vary by connection method. For more information, see the following table.

Feature	Cloud native mode (NLB, CLB, and ECS)	Cloud native mode (ALB, MSE, FC or APIG)	CNAME connection	Hybrid Cloud WAF connection (reverse proxy)	Hybrid Cloud WAF connection (SDK integration)
Web core protection rules	Supported	Supported	Supported	Supported	Supported
Whitelist	Supported	Supported	Supported	Supported	Supported
IP blacklist	Supported	Supported	Supported	Supported	Supported
Custom rules	Supported	Supported	Supported	Supported	Supported
HTTP flood protection	Supported	Supported	Supported	Supported	Supported
Scan protection	Supported	Supported	Supported	Supported	Supported
Location blacklist	Supported	Supported	Supported	Supported	Supported
Web tamper proofing	Supported	Supported only for ALB	Supported	Not supported	Not supported
Data leakage prevention	Supported	Not supported	Supported	Supported	Not supported
Custom response	Supported	Supported	Supported	Supported	Supported
Bot management - automatic web SDK integration	Supported	Not supported	Supported	Supported	Supported
Major event support	Supported	Not supported	Supported	Not supported	Not supported
API security	Supported	Supported only for ALB and APIG	Supported	Supported	Supported
Peak traffic throttling	Supported	Not supported	Supported	Not supported	Supported

How to connect

Cloud native mode:
CNAME connection:
For more information, see Add a domain name to WAF by using the CNAME connection method. After you add a domain name on the WAF console, you must add the WAF back-to-origin IP address ranges to your allowlist and modify the DNS settings for the domain name.
Hybrid Cloud WAF connection (reverse proxy or SDK integration):
For more information, see Add a service to Hybrid Cloud WAF.

How it works

Cloud native mode

When you use cloud native mode to connect instances of ALB, FC, MSE or APIG, WAF uses SDK integration. An SDK embedded in the cloud product extracts, inspects, and protects traffic. Because WAF does not participate in traffic forwarding, this method avoids compatibility and stability issues from an additional forwarding layer.

When you use cloud native mode to connect instances of ECS, CLB, or NLB, WAF uses a transparent proxy. After you configure a traffic redirection port, the cloud product's gateway automatically modifies the route to redirect web traffic to WAF. WAF blocks attack traffic and forwards legitimate requests to the origin server, participating in both traffic forwarding and protection.

CNAME connection

This method uses a reverse proxy. After adding a domain name, you point its DNS record to the WAF CNAME address, which redirects all its web traffic to WAF. WAF then inspects the traffic, blocks attacks, and forwards legitimate requests to the origin server.

Hybrid Cloud WAF connection

The Hybrid Cloud WAF connection method offers two modes: reverse proxy and SDK integration.

Reverse proxy mode: You connect a website domain name or IP address to WAF and then point its DNS record to the WAF protection cluster. All traffic then passes through the cluster for security inspection.
SDK integration mode: A plugin deployed on your unified ingress gateway copies service traffic to the WAF protection cluster for inspection. WAF does not forward the traffic, thereby separating the inspection process from the traffic forwarding path.

FAQ

Cross-cloud and cross-account connections

Yes. If you own a domain name and can modify its DNS records, you can use the CNAME connection method. This method works regardless of your origin server's location.

Connecting with only a public IP

Yes. You can use the cloud native mode, which does not require a domain name.

Connecting IPv6 websites

IPv6 support depends on the connection method:

Cloud product connection (ECS, CLB, and NLB instances): IPv6 websites are not supported. To protect IPv6 workloads, you must use the CNAME connection method. Subscribe to a subscription Enterprise or Ultimate edition, or a pay-as-you-go edition of WAF, and enable More Settings to turn on IPv6 protection. For detailed steps, see Add a domain name to WAF by using the CNAME connection method.
Cloud product connection (instances other than ECS, CLB, and NLB): If the corresponding cloud product instance supports IPv6, WAF also supports IPv6.
WAF Outside Chinese Mainland: When using the CNAME connection method, IPv6 websites are not supported.

Using both cloud native and CNAME connections

No. A domain name can use only one connection method at a time. Using both simultaneously will cause forwarding conflicts and protection failures. To switch a domain from CNAME connection to cloud native mode, you must first point its DNS record back to the origin server. After the DNS change propagates, delete the CNAME connection configuration and then add the domain name again in cloud native mode.

Instance not found during configuration

Possible cause	Solution
The CLB, NLB, or ECS instance does not meet the requirements.	Verify that the instance meets the connection requirements described in Limits for adding CLB instances, Limits for adding NLB instances, and Limits for adding ECS instances.
The CLB instance that you want to add does not have a listener.	To add a listener to a Layer 7 CLB instance, see Add an HTTP listener and Add an HTTPS listener. To add a listener to a Layer 4 CLB instance, see Add a TCP listener.
The CLB, NLB, or ECS instance is not yet synchronized with WAF.	Follow the instructions in Manually sync assets.

Viewing and syncing asset status

Follow these steps to view the connection status of your assets.

Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance.
In the left navigation pane, click Onboarding.
At the top of the page, you can view the number of connected domain name assets and cloud product assets. You can also view the total number of instances that you own for each cloud product. If you recently added or modified a cloud product instance, click Synchronize Assets in the upper-right corner to update WAF immediately.

Connecting a domain to multiple instances

cloud native mode: Connect all relevant cloud product instances, such as the service ports of CLB instances, at the same time to ensure WAF can redirect traffic to all of them.

CNAME connection: Add the domain name by using the CNAME connection method and configure the origin server with the IP addresses or CNAMEs of all relevant cloud product instances.

Connecting multiple domains to one instance

cloud native mode: After you add the cloud product instance, WAF protects all associated domain names with its default policy. If you want to configure different protection rules for specific domain names, you must manually add the domain names as protected objects. For more information, see Manually add a protected object.

CNAME connection: You must add each domain name one by one.

Integration with other products and traffic flow

Yes, WAF can be deployed together with other cloud products. The traffic flow depends on your chosen connection method (CNAME or cloud native mode), as illustrated in the following figures.