Is the Default Rule of CFW "Allow" or "Block" If No Rule Is Configured?

CFW allows all traffic by default. When the CFW toggle is enabled, CFW will start recording traffic logs and generating intrusion prevention alarms. However, no traffic will be blocked at this time since no rules are configured.

How Long Does It Take for an Access Control Rule to Take Effect After It Is Configured?

When CFW rules are configured, it takes about 10 seconds to 1 minute for the rules to take effect.

What Protocols Are Supported by Access Control Rules?

• NAT Firewall supports TCP, UDP, ICMP, HTTP, HTTPS, SMTP, SMTPS, and FTP protocols.
• The inter-VPC firewall supports TCP, UDP, and ICMP protocols.

What Policy Modes Are Supported by Access Control Rules?

CFW supports three policies: Allow, Observe, and Block.

• In Allow mode: Allow the hit traffic and record the rule hit count and traffic logs, but not record access controls.
• In Observe mode: Allow the hit traffic and record the rule hit count, access control logs, and traffic logs.
• In Block mode: Block the access data and record the rule hit count and access control logs, but not record traffic logs.

Under What Circumstances Does Traffic That Parses Domain Names Not Pass Through CFW?

CVM may use a cloud platform's self-built DNS service, and the generated DNS messages will not pass through the Internet boundary, resulting in missing alarms and logs for that part of the domain name access. If you want a CVM to be able to use the domain name detection and alarm features of CFW normally, you can manually change the resolution address in the /etc/resolv.conf file to 8.8.8.8.

Why Cannot Some Inter-VPC Firewall Switches Be Enabled?

Due to routing and IP range conflicts or other reasons, CFW restricts the toggles that cause conflicts. You can eliminate the conflicts according to the toggle error prompts before trying to enable Inter-VPC Firewall.