Is the Default Rule of CFW "Pass" or "Block" If No Rule Is Configured?
CFW passes all traffic by default. After you enable Firewall Toggle, CFW starts to record traffic logs and generate Intrusion Defense alarms, but it does not block any traffic at this point because no rules are configured.
How to Configure CFW to Only Pass Access to Permitted Ports?
1. After enabling the Internet Firewall, choose Access Control > Internet Border Rule > Inbound Rule to go to the Inbound Rule page. 2. On the Inbound Rule page, click Add Rule to allow the ports you need, and also add a rule that blocks all ports.
Note:
Internet Firewall passes all traffic by default when no rules are configured.
How Long Does It Take for an Access Control Rule to Take Effect After It Is Configured?
After you configure rules in CFW, it takes about 10 seconds to 1 minute for the rules to take effect.
Does CFW Support Access Control via Domain Names?
Both Internet Firewall and NAT Firewall support using domain names in Outbound Rules, and inter-VPC firewalls also support domain-based Access Control rules.
Does CFW Support Configuring Limit Policies via Domain Names?
Currently, assets in the Chinese mainland and Hong Kong (China) support configuring restriction policies by domain name.
Does CFW Have the Geo-Blocking Feature?
The Premium Edition and above support the region blocking feature.
Why Can't Some Address Templates Be Selected When Inbound Rules Are Added in CFW?
For inbound traffic, domain templates cannot be selected as either the access source or the access destination. For outbound traffic, domain templates cannot be selected as the access source, but can be selected as the access destination. This is because the access source of outbound traffic is usually a cloud asset rather than a domain name.
What Is the Difference Between the Access Control Feature of CFW (Cloud Firewall) and the Security Group Feature in VPC (Virtual Private Cloud)?
The VPC security group feature is relatively limited and is typically used to set up an allowlist for specific services on servers. We recommend using CFW's Enterprise Security Group, which supports intelligent algorithms for unified policy deployment.
Does CFW Support UDP Protection?
NAT Firewall, Enterprise Security Group, and inter-VPC firewalls support UDP protection, while the Internet border bypass firewall does not.
How Many NAT Firewall Rules Can Be Extended?
Can be expanded to 20,000 entries.
Why Are Observation Rule Entries Still Generated in the Alarm Center After the Internet Firewall is Configured to Block Access from Regions Outside the Chinese Mainland?
1. If no corresponding blocked requests are found in the ACL logs, you need to check whether there are other higher-priority pass rules.
2. If the ACL logs record corresponding blocked requests, this may be caused by the bypass preemption mechanism. If you are concerned about this issue, you can manually block all attack alarms from overseas in the Alarm Center.
Why Do Some Requests Still Appear in the Alarm Center and Are Not Blocked After Access Control Rules Are Configured?
It may be that the Access Control rules are not yet in effect.
When Access Control rules are in effect, this may be caused by packet loss in the bypass of Internet Firewall. The bypass firewall analyzes mirrored network traffic, and some traffic may be matched by the Intrusion Defense system and generate alarms. However, these access requests have actually been blocked.
Does CFW Access Control Support Configuring Specific Effective Time Periods?
We recommend selecting the automation tool on the Common Tool page to configure the effective time of rules, and configure the enable and disable times for the rules based on specific scenarios. What Are the Usage Restrictions for Enabling Long-Lived Connections in NAT Firewall Access Control?
2. Maximum connections are subject to the limitations of bandwidth specifications. For details, see Firewall FAQs. After a domain name is obtained, if the IP address resolved by this domain name conflicts with existing IP address rules, how should it be handled?
Process according to the rules with higher priority.
Can Attackers Bypass by Modifying host After CFW Domain Restriction Rules Are Deployed as IP?
CFW performs blocking based on IP address rules generated by authoritative DNS resolution. Attackers cannot bypass the blocking by modifying the local hosts file, because this does not affect the rules.