Tenant Cloud Security Cloud Firewall Operation Guide

Inter-VPC Rules

Last Updated At: 2026-08-14 08:08:00

An access control list (ACL) is provided for inter-VPC rules. When a rule is created, configure the rule effective scope to provide access control for traffic interconnection between different VPC boundaries. This document describes how to set inter-VPC rules in the CFW console.

Adding Rules

  1. Log in to the CFW console. In the left sidebar, choose Access Control > Inter-VPC Rules.

    Note

    • Unlike the ACLs of the NAT firewall, the inter-VPC ACLs have no direction limitations.
    • The local and peer VPCs are equivalent. When configuring rules, you can determine the VPC based on the CIDR block where the access source and destination are located to differentiate the direction.

  2. On the Inter-VPC Rules page, click Add Rule to go to the Add Rule page.

  3. On the Add Rule page, specify information such as the access source IP address, access destination IP address, destination port number, protocol, policy, and effective scope, and click OK to complete the rule configuration.
    Field description:

  • Priority: execution priorities of access control rules, which are independent of those of the rules in the list of the firewall switch. The rule with the highest priority is matched first. If a rule is hit, rules with lower priorities will not be matched. When you modify the priority of a rule, the priorities of all the subsequent rules will increase by 1. When you delete a rule, the priorities of all the subsequent rules will decrease by 1.
  • Access Source: It can be an IP address or subnet range in the CIDR block of the local or peer VPC. Note that it cannot be in the same VPC IP range as the access destination. You can also enter 0.0.0.0/0 as the access source for wildcard rules. (It only takes effect within the selected scope.) You can click Details to view details of the access source network instance associated with inter-VPC rules.
  • Access Destination: It can be an IP address or subnet range in the CIDR block of the local or peer VPC. Note that it cannot be in the same VPC IP range as the access source. You can also enter 0.0.0.0/0 as the access destination for wildcard rules. (It only takes effect within the selected scope.) You can click Details to view the details of the access destination network instance associated with inter-VPC rules.
  • Destination Port: Single port numbers (such as 80), port ranges (such as 80/80, –1/–1, and 1/65535), and discrete port values separated with commas (such as 80,443,3380/3389) are supported.
  • Protocol: Supported protocols include TCP, UDP, ICMP, HTTP, HTTPS, SMTP, SMTPS, DNS, and FTP.
  • Policy:
    • Allow: Allow the traffic that hits rules and record the hit count and traffic logs, but not record access control logs.
    • Observe: Allow traffic that hits rules and record the hit count, access control logs, and traffic logs.
    • Block: Block the traffic that hits rules, record the hit count and generate access control logs, and record the complete data packet information of the current request in traffic logs.
  • Effective Scope:
    • Global policy: The rule takes effect for all the traffic managed by the inter-VPC firewall.
    • Selecting an inter-VPC firewall switch: The rule takes effect only for inter-VPC traffic managed by the firewall switch.
  • Description: the rule description. It can contain a maximum of 50 characters. You can insert special rule settings by using ##. The current version supports #long connection#, which is suitable for the long connection business scenario.
  • Inter-VPC Wildcard Rule: supports wildcard IP address ranges. For details, see the Internet Boundary Wildcard Rule in Internet Boundary Rules.

    Note

    • The CIDR blocks of the local and peer VPCs for the inter-VPC firewall cannot be the same or overlapped. Otherwise, the firewall cannot be enabled.
    • In inter-VPC access control rules, the access source or access destination can only be an IP address in the CIDR block of the local or peer VPC or a subnet range of it. As the CIDR blocks of the local and peer VPCs cannot be the same, the direction of the traffic controlled by a rule can be distinguished by Access Source or Access Destination.
    • The rule will not take effect if you enter an address other than those in the CIDR block of the local or peer VPC.
    • If Source and Access Destination are set to 0.0.0.0/0, they represent all IP addresses of the VPC.
  1. Click Copy in the operation column on the right side to add multiple rules.

    Note

    In the Add Inbound Rule pop-up window, one line indicates one rule, and a new rule is added to the end of the list by default. That is, the last rule with the largest priority value is assigned the lowest priority.

Scenario 1: The rule list has been edited locally. Multiple rules need to be added in batches to improve efficiency.

  1. Click Copy in the operation column on the right side to add a line of rule below the current position. A maximum of 10 rules can be added at a time.
  2. Complete all fields in the form.
  3. Before you commit the rules, check whether their execution order meets expectations.
  4. Click OK to commit the configured rules.
    Scenario 2: You need to configure multiple rules for an IP address.
  5. Edit a line of rule. Edit only the fields that need to be filled in repeatedly.
  6. Click Copy in the operation column on the right side to add a line of rule below the current position and automatically copy the content that has been filled in from the previous line. A maximum of 10 rules can be added at a time.
  7. Complete other fields in the form and fill in the fields that do not need to be filled in repeatedly.
  8. Before you commit the rules, check whether their execution order meets expectations.
  9. Click OK to commit the configured rules.
  10. After the rules are added, you can view them in the rule list.

Importing Rules

On the Inter-VPC Rules page, click Import Rules to import rules from a local file. You can specify the import location, download the import template, and export existing rules.

Rule Backup and Rollback

For details about rule backup and rollback, see Rule Backup.

Note

Inter-VPC rules backed up before the revision do not support rollback. If needed, submit a ticket to contact technical support engineers.

Related Information

  • If you need to manage inbound and outbound traffic at the Internet boundary in the CFW console, see Internet Boundary Rules.
  • If you need to manage inbound and outbound traffic at the NAT boundary in the CFW console, see NAT Firewall Rules.
  • If you need to learn about the special use cases of the access control feature of CFW, see Special Use Cases.
  • If you encounter issues related to inter-VPC rules, see Inter-VPC Firewall.