- Announcements
- User Guide
- Product Introduction
- Purchase Guide
- Getting Started
- Operation Guide
- Logging in to Linux Instance
- Managing Windows Instance
- Managing ECM Module
- Managing Instance
- Managing Security Group
- Managing Image
- Editing Tag
- EIP Direct Access
- API Documentation
- History
- API Category
- Making API Requests
- Region APIs
- Module APIs
- Instance APIs
- DescribeInstances
- TerminateInstances
- ResetInstancesMaxBandwidth
- ResetInstances
- RebootInstances
- ModifyInstancesAttribute
- DescribeInstancesDeniedActions
- RunInstances
- StopInstances
- StartInstances
- ResetInstancesPassword
- DescribeInstanceVncUrl
- DisassociateSecurityGroups
- AssociateSecurityGroups
- DescribePriceRunInstance
- Image APIs
- VPC APIs
- Subnet APIs
- Route Table APIs
- CLB APIs
- ModifyTargetWeight
- ModifyTargetPort
- ModifyLoadBalancerAttributes
- ModifyListener
- DescribeTargets
- DescribeTargetHealth
- DescribeLoadBalancers
- DescribeLoadBalanceTaskStatus
- DescribeListeners
- DeleteLoadBalancerListeners
- DeleteLoadBalancer
- DeleteListener
- CreateLoadBalancer
- CreateListener
- BatchRegisterTargets
- BatchModifyTargetWeight
- BatchDeregisterTargets
- SetSecurityGroupForLoadbalancers
- SetLoadBalancerSecurityGroups
- ENI APIs
- CreateNetworkInterface
- DescribeNetworkInterfaces
- AttachNetworkInterface
- DetachNetworkInterface
- MigrateNetworkInterface
- AssignPrivateIpAddresses
- RemovePrivateIpAddresses
- MigratePrivateIpAddress
- DeleteNetworkInterface
- ReleaseIpv6Addresses
- ModifyIpv6AddressesAttribute
- AssignIpv6Addresses
- ModifyPrivateIpAddressesAttribute
- EIP APIs
- HAVIP APIs
- Snapshot APIs
- Security Group APIs
- Key APIs
- Other API
- Data Types
- Error Codes
- FAQs
- Glossary
- ECM Policy
- Announcements
- User Guide
- Product Introduction
- Purchase Guide
- Getting Started
- Operation Guide
- Logging in to Linux Instance
- Managing Windows Instance
- Managing ECM Module
- Managing Instance
- Managing Security Group
- Managing Image
- Editing Tag
- EIP Direct Access
- API Documentation
- History
- API Category
- Making API Requests
- Region APIs
- Module APIs
- Instance APIs
- DescribeInstances
- TerminateInstances
- ResetInstancesMaxBandwidth
- ResetInstances
- RebootInstances
- ModifyInstancesAttribute
- DescribeInstancesDeniedActions
- RunInstances
- StopInstances
- StartInstances
- ResetInstancesPassword
- DescribeInstanceVncUrl
- DisassociateSecurityGroups
- AssociateSecurityGroups
- DescribePriceRunInstance
- Image APIs
- VPC APIs
- Subnet APIs
- Route Table APIs
- CLB APIs
- ModifyTargetWeight
- ModifyTargetPort
- ModifyLoadBalancerAttributes
- ModifyListener
- DescribeTargets
- DescribeTargetHealth
- DescribeLoadBalancers
- DescribeLoadBalanceTaskStatus
- DescribeListeners
- DeleteLoadBalancerListeners
- DeleteLoadBalancer
- DeleteListener
- CreateLoadBalancer
- CreateListener
- BatchRegisterTargets
- BatchModifyTargetWeight
- BatchDeregisterTargets
- SetSecurityGroupForLoadbalancers
- SetLoadBalancerSecurityGroups
- ENI APIs
- CreateNetworkInterface
- DescribeNetworkInterfaces
- AttachNetworkInterface
- DetachNetworkInterface
- MigrateNetworkInterface
- AssignPrivateIpAddresses
- RemovePrivateIpAddresses
- MigratePrivateIpAddress
- DeleteNetworkInterface
- ReleaseIpv6Addresses
- ModifyIpv6AddressesAttribute
- AssignIpv6Addresses
- ModifyPrivateIpAddressesAttribute
- EIP APIs
- HAVIP APIs
- Snapshot APIs
- Security Group APIs
- Key APIs
- Other API
- Data Types
- Error Codes
- FAQs
- Glossary
- ECM Policy
By configuring security groups, you can manage access to an ECM instance. You can configure inbound and outbound rules for security groups to specify whether your instance can be accessed by or can access other network resources.
The default inbound and outbound rules for security groups are as follows:
To ensure data security, the inbound rule for a security group is a rejection policy that forbids remote access from external networks. To enable public access to your ECM instances, you need to open the corresponding port to the internet in the inbound rule.
The outbound rule for a security group specifies whether your ECM instance can access external network resources. If you select Open all ports or Open ports 22, 80, 443, and 3389 and the ICMP protocol, the outbound rule for the security group opens all ports to the Internet. If you select a custom security group rule, the outbound rule blocks all ports by default, and you need to configure the outbound rule to open the corresponding port to the Internet.
Common Use Cases
This document provides several common use cases of security groups. You can directly use its recommended security group configurations if a use case meets your requirements.
Scenario 1: remotely connecting to Linux ECM instance over SSH
Case: you have created a Linux ECM instance and want to remotely connect to it over SSH.
Solution: when adding a security group rule, set Type to Linux login and open TCP port 22 to the Internet to enable Linux login via SSH.
You can open all IPs or a specified IP (or IP range) to the internet as required. This enables you to configure the source IPs that can remotely connect to the ECM instance over SSH.
Direction | Type | Source | Protocol Port | Policy |
Inbound | Linux Login | All IP addresses: 0.0.0.0/0 Specified IP address: enter your specified IP address or IP range | TCP: 22 | Allow |
Scenario 2: remotely connecting to Windows ECM instance over RDP
Case: you have created a Windows ECM instance and want to remotely connect to it over RDP.
Solution: when adding a security group rule, set Type to Windows Login and open TCP port 3389 to the Internet to enable remote login to Windows.
You can open all IPs or a specified IP (or IP range) to the internet as required. This enables you to configure the source IPs that can remotely connect to the ECM instance over RDP.
Direction | Type | Source | Protocol Port | Policy |
Inbound | Windows Login | All IP addresses: 0.0.0.0/0 Specified IP address: enter your specified IP address or IP range | TCP: 3389 | Allow |
Scenario 3: pinging server on internet
Case: you have created an ECM instance and want to test whether it can communicate with other ECM instances normally.
Solution: test the connection by using the
ping command. Specifically, when adding a security group rule, set Type to Ping and open Internet Control Message Protocol (ICMP) ports to the internet to enable other ECM instances to access this instance over ICMP.
You can open all IPs or a specified IP (or IP range) to the internet as required. This allows you to configure the source IP addresses that can access this ECM instance over ICMP.Direction | Type | Source | Protocol Port | Policy |
Inbound | Ping | All IP addresses: 0.0.0.0/0 Specified IP address: enter your specified IP address or IP range | ICMP | Allow |
Scenario 4: remotely logging in to ECM instance over Telnet
Case: you want to remotely log in to an ECM instance over Telnet.
Solution: when adding a security group rule, configure the following security group rule:
Direction | Type | Source | Protocol Port | Policy |
Inbound | Custom | All IP addresses: 0.0.0.0/0 Specified IP address: enter your specified IP address or IP range | TCP: 23 | Allow |
Scenario 5: allowing access to a web service through HTTP or HTTPS
Case: you have built a website and want to allow access to your website through HTTP or HTTPS.
Solution: when adding a security group rule, configure the following security group rules as required:
Allow all public IP addresses to access this website
Direction | Type | Source | Protocol Port | Policy |
Inbound | HTTP (80) | 0.0.0.0/0 | TCP: 80 | Allow |
Inbound | HTTPS (443) | 0.0.0.0/0 | TCP: 443 | Allow |
Allow some public IP addresses to visit this website.
Direction | Type | Source | Protocol Port | Policy |
Inbound | HTTP (80) | IP address or IP range that is allowed to access your website | TCP: 80 | Allow |
Inbound | HTTPS (443) | IP address or IP range that is allowed to access your website | TCP: 443 | Allow |
Scenario 6: allowing an external IP address to access a specified port
Case: you have deployed a service and want the specified service port (such as port 1101) to be externally accessible.
Solution: when adding a security group rule, set Type to Custom and open TCP port 1101 to the Internet to allow external access to the specified service port.
You can open all IP addresses or a specified IP address (or IP range) to the Internet as required. This allows the source IP address to access the specified service port.
Direction | Type | Source | Protocol Port | Policy |
Inbound | Custom | All IP addresses: 0.0.0.0/0 Specified IP address: enter your specified IP address or IP range | TCP: 1101 | Allow |
Scenario 7: rejecting an external IP address to access a specified port
Case: you have deployed a service and want to prevent external access to a specified service port (such as port 1102).
Solution: when adding a security group rule, set Type to Custom, configure the TCP port 1102, and set Policy to Reject to reject external access to the specified service port.
Direction | Type | Source | Protocol Port | Policy |
Inbound | Custom | All IP addresses: 0.0.0.0/0 Specified IP address: enter your specified IP address or IP range | TCP: 1102 | Reject |
Scenario 8: allowing ECM instance to access only specified external IP
Case: you want your ECM instance to access only a specified external IP address.
Solution: add two outbound security group rules as follows.
Allow the instance to access a specified external IP address.
Forbid the instance from accessing any public IP addresses through any protocol.
Note:
The first rule takes priority over the second.
Direction | Type | Source | Protocol Port | Policy |
Outbound | Custom | Specified public IP address that the ECM instance can access | Required protocol and port number | Allow |
Outbound | Custom | 0.0.0.0/0 | All | Reject |
Scenario 9: prohibiting ECM instance from accessing specified external IP
Case: you don't want your ECM instance to access a specified external IP address.
Solution: add a security group rule as follows.
Direction | Type | Source | Protocol Port | Policy |
Outbound | Custom | Specified public IP address that your instance cannot access | All | Reject |
Scenario 10: uploading or downloading a file over FTP
Case: you want to allow uploads and downloads over FTP.
Solution: add a security group rule as follows.
Direction | Type | Source | Protocol Port | Policy |
Inbound | Custom | 0.0.0.0/0 | TCP: 20 to 21 | Allow |
Multi-Scenario Configurations
You can configure multiple security group rules to meet your business requirements. For example, both inbound and outbound runes can be simultaneously configured. An ECM instance can be bound to one or multiple security groups. When it is bound to multiple security groups, the security group rules will be matched sequentially from top to bottom. You can adjust the priorities of security groups at any time. For more information about the priorities, see Rule Priorities.
Yes
No
Was this page helpful?