After you set up Barracuda WAF-as-a-Service for one or more of your applications, ensure that users cannot access your application server directly, without going through Barracuda WAF-as-a-Service.
Be sure to follow these procedures if you change the deployment location of your applications. For details, refer to Moving an Application to Another Location.
Restricting Direct Traffic
For accounts created on or after November 5, 2019
Barracuda WAF-as-a-Service provides the IP ranges you need to accept.
To locate the IP ranges:
- Log into Barracuda WAF-as-a-Service and navigate to Applications.
- Click the application name.
- In the left panel, select Endpoints.
- On the Endpoints page, locate the IP Ranges to Allow section. Click Show IPs, then copy the IP ranges listed.
- Configure your backend server to accept traffic only from those IP ranges. See sections below for guidance.
For accounts created before November 5, 2019
Configure your application server to accept traffic only from the following Barracuda IP ranges.
Allowing IPs for Exporting Logs
If you will be exporting log information, as described in Log Export, now is a good time to allow those IPs as well.
To export logs, be sure to allow the following IPs:
Configuring Your Backend Server
Consult your backend server documentation for specific instructions on this process. Here are links to some backend server documentation sets.
Host-Based Network Firewall
Cloud-Based Networks and Firewalls
- Barracuda CloudGen Firewall Access Rules
- Microsoft Azure Network Security Groups
- Amazon Web Services Security Groups
- Google Cloud Platform VPC Firewall Rules