Enabling the IPv6 Protection Feature for WAF with One Click
Download
フォーカスモード
フォントサイズ
最終更新日: 2026-08-06 15:20:07
AI翻訳
If your website requires IPv6 protection, you can refer to this section to route IPv6 service traffic through WAF for protection. After this feature is enabled, WAF assigns an IPv6 WAF VIP address to your domain and detects and filters abnormal traffic from IPv6 access requests.
Prerequisites
If your CLB instance has IPv6 listeners enabled, it can directly process requests from IPv6 clients. In this case, the CLB-based WAF supports all editions in handling IPv6 service traffic, requiring no additional configuration.
The IPv6 protection feature for SaaS-based WAF is currently supported only in the Enterprise edition and above.
Before enabling the IPv6 access feature, ensure that your origin server business is compatible with IPv6. Additionally, you need to add an IPv6 origin-pull address to your origin server configuration so that WAF can correctly forward legitimate traffic back to your origin server over the IPv6 protocol.
Operation Step
1. Log in to the WAF console. At the top of the left sidebar, switch the console to the region where your instance is located (Chinese mainland/Non-Chinese mainland).
2. In the left sidebar, choose Connection Management > Domain Onboarding.
3. In the domain connection list, select the domain for which you want to enable the IPv6 feature. Then, in the Operation column, choose Other Configurations > IPv6 Connection.
4. On the Advanced settings page, enable the IPv6 connection switch.
5. Click OK to enable IPv6 protection.
6. Verify whether IPv6 is enabled. After you run the `dig` command to query the AAAA record of your domain, you can check whether WAF has IPv6 enabled. The appearance of an IPv6 address indicates that IPv6 has been successfully enabled.
Note:
Whether an origin server supports IPv6 origin-pull depends on its own configuration, not on whether IPv6 access is enabled.
FAQs
Does the Access End Support IPv6 Access If the Origin Server Is Not Configured for IPv6 Origin-Pull?
When the origin server has no IPv6 resources and the client accesses it over IPv6, WAF automatically converts the traffic to IPv4 for origin-pull.
Does the Access End Support IPv4 Access If the Origin Server Is Not Configured for IPv4 Origin-Pull?
When the origin server has no IPv4 resources and the client accesses it over IPv4, WAF automatically converts the traffic to IPv6 for origin-pull.
That is, WAF automatically converts IPv4 and IPv6 to make them compatible with the origin-pull method required by the origin server.
How to Handle Abnormal Errors Such As "Cluster Node Upgrade in Progress for the Instance" After IPv6 Access Is Enabled?
When an abnormal error occurs, please Submit Ticket for resolution.
Does Enabling IPv6 Access Support Enabling a Single Domain Name?
Currently, it supports enabling IPv6 for a single domain name.
