Huawei Cloud Account Marketplace How to configure firewall rules on Huawei Cloud

How to configure firewall rules on Huawei Cloud (with the stuff you actually need when setting up your account + rules)

If you’re searching “How to configure firewall rules on Huawei Cloud”, you’re probably not looking for definitions—you’re trying to (1) get access working fast for a new project, (2) avoid security-group surprises, (3) publish an application safely, and (4) do it without getting your account stuck in verification/risk control.

Below is how I’d approach this based on real operational patterns: first the account steps that unblock the console, then the firewall rule workflow that usually causes issues, and finally the risk/cost considerations people only notice after failing a first deployment.

What you’re most likely trying to do (and the rules setup that matches it)

Most “firewall rules” searches fall into one of these scenarios. Each scenario maps to different settings and different failure points.

Scenario A: Expose a web service (80/443) to the Internet, keep everything else locked

• Create an access control policy that allows inbound TCP 80 and 443 from your office/VPN/public IPs (or 0.0.0.0/0 temporarily for test).
• Explicitly deny is usually not needed if the default policy is “deny inbound”. Instead, you control allow rules.
• Huawei Cloud Account Marketplace Verify return traffic isn’t blocked (stateful firewalls typically handle this, but misconfigured ports can break TLS handshakes).

Scenario B: Allow only SSH from a fixed IP, block everyone else

• Inbound TCP 22 allow rule with a narrow source CIDR (your static egress IP).
• Turn off “0.0.0.0/0 for SSH” even in staging—this is a top cause of brute-force noise and automated scan events.

Scenario C: Inter-service traffic inside VPC/subnets (microservices or internal APIs)

• Use security group / network ACL rules that reference internal IP ranges or security group targets (depends on the service you use).
• Huawei Cloud Account Marketplace If services scale, don’t hardcode instance IPs—use group-based targeting where possible.

Scenario D: You need outbound restrictions (egress control for compliance)

• Some setups fail because teams assume “inbound rules only.” For compliance, you must also evaluate outbound policy availability.
• If outbound policies are limited in your chosen firewall service, consider layering with NAT gateway / egress firewall options.

Before you touch firewall rules: the account steps that determine whether you can even apply them

In practice, the biggest delays aren’t firewall clicks—they’re account activation, payment readiness, and risk checks that throttle resource operations.

1) Purchase / setup: avoid the “I bought it but I can’t enable network controls” trap

When you buy cloud services (whether by credit card, bank transfer, or invoicing), Huawei Cloud typically requires that:

• Huawei Cloud Account Marketplace your account is in a verified/usable state (KYC completed), and
• your billing method is active (prepaid or postpaid depending on your model),
• your project/region isn’t blocked by risk controls.

If you see you can browse the console but actions fail (“permission denied”, “operation not allowed”), it’s often not a firewall configuration error—it’s account/region policy gating.

2) Identity verification (KYC): what matters for network/security services

For many teams, KYC delays show up exactly when they need to configure public access. Common KYC requirements include:

• Individual vs enterprise verification (enterprise verification usually has extra document steps).
• Address/ID document validity and consistency with account holder info.
• Company registration details and business scope alignment for enterprise accounts.

Common failure reasons I’ve seen:

• Name mismatch between account profile and ID document.
• Expired or low-quality document photos (blurry edges are a frequent rejection).
• Enterprise documents uploaded in the wrong language format or missing required stamps.
• Submitting from a different region/VPN pattern repeatedly (some systems flag it as suspicious activity).

3) Funding and renewals: don’t let billing lapse mid-deployment

Firewall changes are usually immediate, but enabling certain network components can require resources with active billing state. If your payment method fails or prepaid credits expire, you may end up with partial connectivity:

• security rules may be created but not applied to running instances;
• associated network gateways may fail to provision;
• your application might still be reachable temporarily, then drop after enforcement changes.

If you’re on prepaid, check renewal schedules. If you’re on postpaid, monitor spend thresholds so risk control doesn’t restrict operations when spend exceeds policy.

Real-world firewall workflow in Huawei Cloud (the order that prevents most errors)

Different Huawei Cloud offerings (security groups, VPC, network ACL, WAF, etc.) can have different naming in the console. The high-level operational workflow is consistent, and the failure points are predictable.

Step 1: Identify the traffic path (Internet → LB/WAF → instance → service port)

Before creating rules, map how traffic enters your environment. I’ve seen teams open port 443 on the instance, while the load balancer or gateway is the actual entry point—and the instance still never receives packets because the upstream layer blocks it.

• If you use a load balancer: open required listeners/health check ports at the LB layer and ensure backend targets accept the traffic.
• If you use WAF: remember WAF may sit in front and can block traffic before it hits firewall rules at the instance.

Step 2: Choose the rule scope (instance-level vs subnet/VPC-level)

A common mistake is applying rules at the wrong scope:

• Over-scoping (broad “allow all” at VPC level) creates compliance issues and increases scanning noise.
• Under-scoping (only opening instance firewall, forgetting security-group association) results in time wasted debugging.

Practical tip: start with the smallest scope that still covers the traffic path you actually use.

Step 3: Create allow rules with correct protocol/port and narrow source CIDR

The rule fields that repeatedly cause “it doesn’t work”:

• Protocol: “TCP” vs “All” matters (especially when services use HTTP/HTTPS variations).
• Port range: ensure the exact port. For example, Kubernetes NodePort or custom admin ports require explicit ranges.
• Source CIDR: your corporate NAT may change egress IP. If it changes, your rule looks correct but traffic is blocked.

Step 4: Apply rule association (attach security group / bind to instances)

Some firewall mechanisms are policy-based, meaning rules exist but aren’t active until associated with the correct network resource. For example, security groups typically must be attached to instances or network interfaces.

In operations, this is where “I created the rule but nothing changes” happens.

Step 5: Validate using a stepwise test (not one giant test)

• Test from the exact source CIDR you allowed (use a known fixed egress IP).
• Confirm DNS points to the right load balancer/entry IP.
• Check application listens on expected ports (localhost vs 0.0.0.0 binding issues are surprisingly common).
• Use packet-level observation if available (or logs) to see whether traffic is dropped before reaching the instance.

Cost comparisons: how firewall choices affect bills (and how to avoid hidden spend)

Firewall “rules” themselves are usually cheap, but the overall network design you choose can add cost quickly. The cost delta tends to show up only after you change the approach.

1) Security group style controls vs “traffic inspection” services

• Basic port allow/deny controls (security group-like) usually do not scale with traffic volume in a heavy way.
• Inspection/advanced perimeter services (WAF-like layers, gateway inspection) can be billed per request/throughput.

2) Load balancer and gateway are often the real cost drivers

If your goal is simply to expose 80/443, a load balancer might be necessary depending on your architecture. But if you over-allocate (multi-zone, extra listeners, unnecessary health checks), costs rise.

Huawei Cloud Account Marketplace 3) Rule maintenance can affect operational cost

If you use overly broad source rules (“0.0.0.0/0 for SSH”), you’ll likely consume more defensive resources (rate limiting, WAF tuning, logging retention). That’s not always visible in the firewall bill line items, but it impacts your real cost.

Actionable approach:

• Start minimal: allow only required ports and only from required sources.
• Add layers (WAF, L7 policies) only after traffic pattern proves the need.
• Set logging retention consciously—logging/storage can become your silent cost center.

Risk control and compliance: what happens when firewall rules look “suspicious”

Cloud accounts—especially newly activated ones—can be subject to risk control reviews. When you quickly open public inbound access with broad ranges, the platform may flag it for additional checks or temporary restrictions.

Common risk-control triggers

• Public exposure of admin ports (22/3389/others) from 0.0.0.0/0.
• Very broad allow rules combined with unusual traffic patterns soon after provisioning.
• Frequent changes to network access rules without stable deployment history.
• Mismatch between expected usage and account profile (e.g., account verified as personal, but you deploy large-scale public services immediately).

Huawei Cloud Account Marketplace Operational mitigation (what I recommend)

• Use narrow CIDR for SSH/RDP immediately.
• Open public ports only for necessary services (80/443) and avoid exposing internal ports.
• When onboarding a new app, do it in stages: internal test → limited external access → full scale.

Usage restrictions you should expect

If the platform detects high-risk behavior, you might see:

• delayed application of certain network changes,
• temporary restrictions on provisioning related resources,
• additional verification requests (especially if documents are already near expiration or inconsistent).

Payment methods and billing state: why it can break your firewall rollout

Users often assume firewall configuration is independent of billing. It isn’t in practice. Below are the patterns that repeatedly affect deployment timelines.

Credit card vs bank transfer vs invoicing (practical differences)

• Credit card: fastest activation in many cases; however, if chargebacks/funding issues happen, services can be suspended quickly.
• Bank transfer: may require processing time; also consider whether the funds are tied to specific account/project or region.
• Invoicing/enterprise billing: helps for procurement, but the account might have provisioning limits until invoice/contract is fully processed.

Data-driven checklist before you “go public”

• Verify the account shows “billing normal” in the console (not just “resources exist”).
• Confirm there is sufficient balance/credit for the network components you enabled (LB/gateway/logging/WAF if any).
• Schedule renewals if you use prepaid; don’t rely on “set and forget”.

Common firewall rule mistakes on Huawei Cloud (and what to check first)

“I added inbound TCP 443 but the site still won’t load”

• You allowed the port on the instance but your traffic hits a load balancer first (LB listener/target group not configured).
• Your server binds only to localhost (service runs but doesn’t accept external connections).
• TLS certificate/SNI mismatch looks like firewall failure from outside—verify with a browser/network trace.

“SSH works from my laptop, not from my office network”

• Your office egress IP changed (common when they rotate NAT gateways).
• You allowed the wrong CIDR (e.g., didn’t account for your ISP subnet).
• Order of operations: instance security group attached after rule creation—check association.

“Rules are there but nothing changes”

• Policy not associated to the correct network interface/resource.
• Huawei Cloud Account Marketplace Wrong region/project: rules created in one project while instances run in another.
• Application uses a different port than expected (container port mapping misconfigured).

“We’re compliant but security scans keep hitting us”

• If you opened only 80/443, scanners will still probe other ports—don’t panic. But ensure you didn’t accidentally expose admin ports.
• Confirm you didn’t create “any protocol / any port” rules under a different security group attached to instances.
• Consider adding rate limiting at the perimeter layer if you have it in your architecture.

FAQ users usually ask right before/while configuring firewall rules

Huawei Cloud Account Marketplace Q1: Do I need to configure firewall rules before the account is KYC-complete?

In most cases you can view some console items, but applying network changes can be blocked or delayed. If you’re aiming for public access (80/443) quickly, complete KYC first to avoid “I created it but it didn’t take effect” scenarios during deployment.

Q2: Why does the console let me create rules but my instances can’t be reached?

The usual causes are association/scope mismatch: rules created at the wrong resource level, or security group not attached to the instance NIC. Also check load balancer/WAF layers that may block traffic upstream.

Q3: What’s the safest default setup for a new project?

• Public inbound: only allow 80 and 443 (and only from 0.0.0.0/0 if necessary for test; otherwise restrict).
• SSH: allow only your static egress CIDR.
• Everything else: no allow rules (deny-by-default behavior).
• Validate after each change with a source IP you know is correct.

Q4: Can I temporarily open ports for testing and then close them?

Yes, but don’t keep dangerous ports open longer than necessary. From a risk control perspective, repeated opening/closing (especially broad admin exposure) can trigger additional review. Stage it: limited source CIDR first, then expand if absolutely required.

Q5: What about outbound traffic—do I have to configure it too?

If your compliance or security posture requires egress control, confirm whether the firewall mechanism you’re using supports outbound rules. Otherwise, you may need additional components (egress gateway/NAT layer with policy).

Q6: How do I estimate cost for firewall-related changes?

Treat “advanced inspection/perimeter services” as potentially request/throughput-billed, while pure port allow/deny controls are usually not the major cost driver. Check whether your changes involve adding LB/WAF/logging storage, and model those first.

Hands-on checklist you can follow in the next 30 minutes

1. Confirm billing state: ensure your account/project is fully usable (no payment hold, credits not expired).
2. Confirm KYC is complete: if it’s pending/partial, expect restrictions on some network actions.
3. Map traffic entry: Internet → (LB/WAF?) → instance port.
4. Create minimal allow rules:
   • HTTP 80 TCP and HTTPS 443 TCP
   • SSH 22 TCP only from your static egress CIDR
5. Associate rules to the correct instance/network interface/security group (most “rules don’t work” cases are here).
6. Huawei Cloud Account Marketplace Test from the allowed source IP, then check logs if available.
7. Re-tighten scope immediately after test—don’t leave broad allowances in place.

Quick request: tell me your setup and I’ll suggest the exact rule set

If you share these details, I can give a precise inbound rule list and the typical association points to check (without guessing):

• Are you using a load balancer and/or WAF?
• Which service ports do you need (80/443/SSH/custom)?
• Do you need access from your office IP only, or public users?
• Huawei Cloud Account Marketplace What region/project model are you using?
• Are you on prepaid or postpaid?