Security group use cases

Security groups are configured to manage access to Cloud Virtual Machines (CVMs). You can configure inbound and outbound rules for security groups to specify whether your CVMs can be accessed or can access other network resources.
The default inbound and outbound rules for security groups are as follows:

• ** To ensure data security, the inbound rule for a security group is a rejection policy that forbids remote access from external networks. ** To enable external network access to your CVM, you need to open the inbound rule of the corresponding port to the Internet.
• The outbound rule for a security group specifies whether your CVM can access external network resources. If you select "Open All Ports" or "Open Ports 22,80,443, and 3389 and ICMP", the outbound rule for the security group opens all ports to the Internet. If you select a custom security group rule, the outbound rule rejects all ports by default, and you need to configure the outbound rule to allow the corresponding port to access external network resources.

Common use cases

This document describes several common use cases of security groups. If the following cases meet your requirements, you can configure the security groups according to the recommended configurations for the corresponding use cases.

Scenario 1: Remotely connecting to a Linux CVM via SSH

Case : You have created a Linux CVM and want to connect to the CVM via SSH remotely.
Solution When adding security group rules, select "Linux login" in "Type", Protocol port Enable 22, and Open to Internet Linux SSH login.
You can open all IP addresses or a specified IP address (or IP address range) to the Internet as required. This allows you to configure the source IP addresses of the CVMs that can be remotely connected to via SSH.

Scenario 2: Remotely connecting to a Windows CVM via RDP

Case : You have created a Windows CVM and want to remotely connect to the CVM via Remote Desktop (RDP).
Solution When adding security group rules, select "Windows login" in "Type", Enable port 3389 Protocol, Open to Internet Windows remote login.
You can open all IP addresses or a specified IP address (or IP address range) to the Internet as required. This allows you to configure the source IP addresses of the CVMs that can be remotely connected to via RDP.

Scenario 3: Pinging a CVM in a public network

Case : You have created a CVM and want to test whether its communication with other CVMs is normal.
Solution Use the ping program for testing That is, when adding security group rules, select the "type" as "Ping", Enable ICMP Protocol port, and allow other Cloud Virtual Machine to pass through ICMP Protocol Access this Cloud Virtual Machine.
You can open all IP addresses or a specified IP address (or IP address range) to the Internet as required. This allows you to configure the source IP addresses of the CVMs that can access this CVM via ICMP.

Scenario 4: Remotely logging in to a CVM via Telnet

Case : You want to remotely log in to a CVM via Telnet.
Solution If you need to log in to Cloud Virtual Machine remotely through Telnet, you need to configure the following security group rules when adding security group rules:

Scenario 5: Opening access to a web service via HTTP or HTTPS

Case : You have built a website and want users to be able to access your website via HTTP or HTTPS.
Solution If you need Access website through HTTP or HTTPS, you need to configure the following security group rules according to your actual needs when adding security group rules:

• Allow all IP addresses in the public network to access this website.

Scenario 6: Allowing an external IP address to access a specified port

Case : You have deployed a service and want the specified service port (such as 1101) to be externally accessible.
Solution When adding security group rules, select "Custom" in "Type", Enable 1101 Protocol port, which allows the service port specified by Access.
You can open all IP addresses or a specified IP address (or IP address range) to the Internet as required. This allows the source IP address to access the specified service port.

Scenario 7: Rejecting access to a specified port by external IP addresses

Case : You have deployed a service and want to prevent external access to a specified service port (such as 1102).
Solution When adding security group rules, select "Custom" in "Type", configure Port 1102 of Protocol, set "Policy" to "reject", and reject the service port specified by Access.

Scenario 8: Allowing a CVM to access only a specified external IP address

Case : You want your CVM to access only a specified external IP address.
Solution : Add two outbound security group rules by following these configurations:

• Allow the CVM instance to access a specified external IP address.
• Forbid the CVM instance from accessing any public IP addresses via any protocol.

Rules that permit access take priority over those that forbid access.

Scenario 9: Prohibiting a CVM from accessing a specified external IP address

Case : You do not want your CVM to access a specified external IP address.
-Solution : Add a security group rule by following these configuration:

Scenario 10: Uploading or downloading a file from a CVM via FTP

Case : You want to upload a file to or download a file from a CVM by using the FTP software.
-Solution : Add a security group rule by following these configuration:

Combination of multiple security rules

In a real scenario, you may need to configure multiple security group rules based on your business requirements, such as configuring inbound or outbound rules at the same time. One CVM may be bound to one or more security groups. When a CVM is bound to multiple security groups, security groups are matched and executed in descending order of priority. You can adjust the priority of the security group at any time. For priority of security group rules, see Security Group Priority .