Security groups are configured to manage whether a Cloud Virtual Machine (CVM) can be accessed. You can configure inbound and outbound rules for security groups to specify whether your server can be accessed or can access other network resources.
Default inbound and outbound rules for security groups are as follows:
This document introduces several common use cases for security groups. If any of the following cases meets your requirements, you can set your security groups according to the configuration recommended for the corresponding use case.
Case: You have created a Linux CVM and want to remotely connect to the CVM via SSH.
Solution: When Adding an Inbound Rule, set Type to Linux login and open TCP port 22 to the Internet to allow Linux login via SSH.
You can open all IP addresses or a specified IP address (or IP address range) to the Internet as required. This allows you to configure the source IP addresses of the CVMs that can be remotely connected to via SSH.
Direction | Type | Source | Protocol and Port | Policy |
---|---|---|---|---|
Inbound | Linux login |
| TCP: 22 | Allow |
Case: You have created a Windows CVM and want to remotely connect to the CVM via Remote Desktop Connection (RDP).
Solution: When Adding an Inbound Rule, set Type to Windows login and open TCP port 3389 to the Internet to enable remote login to Windows.
You can open all IP addresses or a specified IP address (or IP address range) to the Internet as required. This enables you to configure the source IP addresses of the CVMs that can be remotely connected to via RDP.
Direction | Type | Source | Protocol and Port | Policy |
---|---|---|---|---|
Inbound | Windows login |
| TCP: 3389 | Allow |
Case: You have created a CVM and want to test whether the communication between this CVM and other CVMs is normal.
Solution: Test the connection by using the ping program. Specifically, when Adding an Inbound Rule, set Type to Ping and open Internet Control Message Protocol (ICMP) ports to the Internet to enable other CVMs to gain access to this CVM by using ICMP.
You can open all IP addresses or a specified IP address (or IP address range) to the Internet as required. This allows you to configure the source IP addresses of the CVMs that can gain access to this CVM by using ICMP.
Direction | Type | Source | Protocol and Port | Policy |
---|---|---|---|---|
Inbound | Ping |
| ICMP | Allow |
Case: You want to remotely log in to a CVM via Telnet.
Solution: When Adding an Inbound Rule, configure the following security group rule:
Direction | Type | Source | Protocol and Port | Policy |
---|---|---|---|---|
Inbound | Custom |
| TCP: 23 | Allow |
Case: You have built a website and want to allow users to access your website via HTTP or HTTPS.
Solution: When Adding an Inbound Rule, configure the following security group rules as required:
Direction | Type | Source | Protocol and Port | Policy |
---|---|---|---|---|
Inbound | HTTP (80) | 0.0.0.0/0 | TCP: 80 | Allow |
Inbound | HTTPS (443) | 0.0.0.0/0 | TCP: 443 | Allow |
Direction | Type | Source | Protocol and Port | Policy |
---|---|---|---|---|
Inbound | HTTP (80) | The IP address or IP address range that is allowed to access your website | TCP: 80 | Allow |
Inbound | HTTPS (443) | The IP address or IP address range that is allowed to access your website | TCP: 443 | Allow |
Case: You have deployed a service and want the specified service port (such as port 1101) to be externally accessible.
Solution: When Adding an Inbound Rule, set Type to Custom and open TCP port 1101 to the Internet to allow external access to the specified service port.
You can open all IP addresses or a specified IP address (or IP address range) to the Internet as required. This allows the source IP address to access the specified service port.
Direction | Type | Source | Protocol and Port | Policy |
---|---|---|---|---|
Inbound | Custom |
| TCP: 1101 | Allow |
Case: You have deployed a service and want to prevent external access to a specified service port (such as port 1102).
Solution: When Adding an Inbound Rule, set Type to Custom, configure TCP port 1102, and set Policy to Reject to deny external access to the specified service port.
Direction | Type | Source | Protocol and Port | Policy |
---|---|---|---|---|
Inbound | Custom |
| TCP: 1102 | Reject |
Case: You want your CVM to access only a specified external IP address.
Solution: Add two outbound security group rules by referring to the following configurations:
Rules that permit access have a higher priority than those that deny access.
Direction | Type | Source | Protocol and Port | Policy |
---|---|---|---|---|
Outbound | Custom | The specified public IP address that can be accessed by the CVM | The required protocol and port | Allow |
Outbound | Custom | 0.0.0.0/0 | All | Reject |
Case: You do not want your CVM to access a specified external IP address.
-Solution: Add a security group rule by referring to the following configuration:
Direction | Type | Source | Protocol and Port | Policy |
---|---|---|---|---|
Outbound | Custom | The specified public IP address that you do not want to be accessed by the CVM | All | Reject |
Case: You want to upload a file to or download a file from a CVM by using an FTP program.
-Solution: Add a security group rule by referring to the following configuration:
Direction | Type | Source | Protocol and Port | Policy |
---|---|---|---|---|
Inbound | Custom | 0.0.0.0/0 | TCP: 20 to 21 | Allow |
In an actual scenario, you may want to configure multiple security group rules based on service requirements; for example, configuring inbound or outbound rules at the same time. One CVM may be bound to one or more security groups. When a CVM is bound to multiple security groups, these security groups are matched and executed in descending order of priorities. You can adjust the priorities of these security groups whenever needed. For more information about the priorities of security group rules, see Rule Priorities.
Was this page helpful?