What Is CFW?
Tencent Cloud Firewall (CFW) is a SaaS-based firewall in public cloud environments. It primarily provides internet boundary protection for users and addresses unified management of cloud access control and log auditing. While offering traditional firewall features, it also supports multi-tenancy and elastic scaling in the cloud, serving as the network security infrastructure for users migrating their business to the cloud.
Can CFW Protect Assets Not on Tencent Cloud?
The firewall can only protect IP address assets under Tencent Cloud accounts and does not support assets outside Tencent Cloud.
What Are the Differences Between CFW and Security Groups?
CFW and security groups are two independent systems. When the Internet toggle for a public IP address is enabled, traffic is allowed only if the policies are both set to allow.
They control different targets. The Internet Firewall controls public network access traffic of public IP addresses, while security groups control all traffic of CVM NICs.
CFW and security groups operate at different granularities. Security groups apply to instances, while CFW applies to public IP addresses, NAT border protection, and Peering Connection or CCN between VPCs.
Security group ACLs are only the most basic feature of CFW. More importantly, CFW provides real-time interception capabilities with full traffic Log Auditing and Intrusion Defense (IPS).
What Are the Differences Between CFW and WAF?
WAF only protects Web services and cannot protect non-Web services. It only defends against inbound attacks and cannot monitor or defend against malicious outbound connections initiated by services.
CFW covers protection for all services, supports basic protection against Web vulnerabilities, detects proactive outbound traffic from internal to external networks, and automatically blocks compromised hosts and malicious outbound behaviors.
Can CFW Protect CDN or COS?
CFW does not support protection for SaaS-based service products such as CDN, COS, Anti-DDoS IP, SaaS-WAF, and CDB, except for databases.
Does Traffic Pass Through the Firewall Before Other Products? Is CDN Traffic Protected by the Firewall?
CDN node IP addresses are owned by CDN providers and are not within the protection scope of your CFW. They are only inspected by CFW when CDN pulls origin from CLB or CVM. Anti-DDoS IP addresses also pass through CFW when pulling origin to CLB, but the addresses seen are all origin-pull addresses of Anti-DDoS IPs.
The current version supports BGP IP address as the public IP address type and does not currently support triple-line IP address. When identifying user assets, CFW automatically filters out triple-line IP addresses.
Does CFW Have QPS Limits?
CFW is a SaaS-based service and does not impose limits on concurrency, new connections, or QPS like traditional hardware firewalls. The only performance metric for CFW is actual bandwidth throughput.
Does External Inbound Traffic Pass Through CFW or WAF First?
For Inbound Traffic
SaaS-WAF and CFW together form the overall boundary protection for cloud network security. WAF focuses more on protecting encrypted HTTPS traffic, while non-encrypted traffic is protected by the basic rules and virtual patches of the Intrusion Defense (IPS) integrated in CFW.
SaaS-WAF and CFW work in parallel. Traffic that passes through SaaS-WAF does not pass through CFW. If serial deployment is required, use CLB-WAF, where traffic passes through CFW first and then through CLB-WAF.
Note:
Traffic from SaaS-WAF pulling origin to CLB/CVM does not pass through CFW either. Proactive outbound connections from the origin CVM can be identified and detected by the NAT Firewall.
For Outbound Traffic
You can use the NAT Firewall to implement proactive outbound control at the granularity of Cloud Virtual Machine (CVM) instances, and support domain-based Access Control. Combined with Tencent threat intelligence, the NAT Firewall can automatically block malicious IP addresses and domains involved in proactive outbound connections.
If NAT Firewall is not enabled, you can only perform Access Control on traffic behind the NAT Gateway through the Internet Firewall. In this case, CFW sees only public IP addresses.