- Tutorial
- Release Notes and Announcements
- Release Notes
- Public Image Release Notes
- Announcements
- Temporary Solution for the Windows Blue Screen Issue Caused by CrowdStrike Security Software on July 19, 2024
- Announcement on Flexible Discounts for Spot Instances in Some Regions
- Updating Some Image Pip Package Management Tools for CentOS 7
- CentOS 8 End of Maintenance
- Discontinuation of Support for SUSE Commercial Images
- Price Reduction in Selected Availability Zones
- OrcaTerm Proxy IP Addresses Updates
- Pay-as-you-go Price Adjustments for Standard S3 CVMs in the Silicon Valley Region
- Vulnerability repairing for Linux images
- Stopping supporting for Ubuntu 10.04 images
- Solution to Tomcat Start Failure on Ubuntu14.04
- Upgrading Virtio network card drive for Windows CVMs
- About Configuration of Security Group Port 53
- Windows Server 2003 System Images End of Support Announcement
- End of Support for Windows Server 2008 R2 Enterprise Edition SP1 64-bit System Images
- Product Introduction
- Purchase Guide
- Getting Started
- Operation Guide
- Operation Guide Overview
- Use Limits
- Convenience Features
- Instances
- Creating Instances
- Managing Instance Launch Template
- Batch Sequential Naming or Pattern String-Based Naming
- Logging In to Linux Instances
- Logging in to Windows instance
- Adjusting Configuration
- View Instance Details
- Renaming Instances
- Resetting Instance Password
- Managing Instance IPs
- Changing Security Group
- Conversion from Pay-As-You-Go to Monthly Subscription
- Searching for Instances
- Exporting Instance List
- Renewing Instances
- Starting Up Instances
- Shutting Down Instances
- Restarting Instances
- Reinstalling System
- Using Tencent Cloud Automation Tools to execute commands
- Terminating/Returning Instances
- Enabling Instance Termination Protection
- Instance Repossession or Recovering
- Spot Instances
- Querying the Repossession Status of a Spot Instance
- No Charges When Shut Down for Pay-as-You-Go Instances
- Managing Roles
- Enabling and Disabling Hyper-Threading
- Reserved Instances
- Images
- Migrating Servers
- Maintenance Tasks
- Cloud Disks
- Networking
- Security
- Security Groups
- Protection of Sensitive Operations
- Managing Login Password
- Managing SSH Keys
- Spread Placement Group
- Unblocking Port 25
- Tags
- Monitoring and Alarms
- Sample Console Configuration
- Practical Tutorial
- Best Practices
- Choosing the CVM Model
- Setting up a Website
- Building an Environment
- Building a Website
- Building an Application
- Sending Emails through Port 465
- Building a Visual GUI
- Data Backup
- Uploading Local Files to CVM
- Copying Local Files to CVMs
- Uploading Files from Windows to a Windows CVM via MSTSC
- Uploading Files from MacOS to Windows CVM Using MRD
- Uploading Files from Linux to Windows CVM using RDP
- Uploading files via WinSCP to a Linux CVM from Windows
- Uploading Files from Linux or MacOS to Linux CVM via SCP
- Uploading Files from Linux to a CVM Using FTP
- Uploading Files from Windows to a CVM Using FTP
- Other CVM Operations
- CVM Access to COS via a Private Network
- Best Practices for Boot Mode Legacy BIOS and UEFI
- Recovering Data on Linux CVMs
- Managing Disk Space on Windows CVMs
- Changing Kernel of a Linux Instance Manually
- Setting Up Windows-based AD Domain on a CVM
- Network Performance Test
- High-throughput Network Performance Test
- Using USB/IP to Share USB Devices in Linux
- Using RemoteFx to Redirect USB Devices in Windows
- Using AVX-512 Instructions to Accelerate AI Applications on CVM
- Building Tencent SGX Confidential Computing Environment
- Configuring Persistent Memory in M6p Instances
- Calling Cloud APIs via Python to Share Custom Images in Batches
- Customizing DNS Configuration (Linux System)
- Operations Guide
- Initializing Data Disks
- Environment Configurations
- Installing Software
- User Data
- Work with Operating Systems
- System Activation
- System Updates
- System Shutdown
- Configuring High-performance Power Management
- Windows Recovery Mode
- Updating the Virtio ENI Driver
- Modifying SID
- Modifying VNC Resolution
- Ensuring Unique SIDs for CVMs Using Sysprep
- Use of the atop Monitoring Tools by Linux Instances
- Introduction to Linux Kernel Parameters
- Others
- Troubleshooting
- Instance-Related Failures
- CVM Login Failures
- Windows Instance Login Failures
- Windows Instance Login Failures
- An authentication error occurred when you tried to log in to a Windows instance remotely
- Failed to Reset the CVM Password or the CVM Password Is Invalid
- Connection to a Windows CVM through Remote Desktop was denied
- Requires network-level identity verification
- Problems occurred when you tried to log in to a Windows CVM remotely on Mac
- Failed to log in to a Windows CVM due to high CPU and memory usage
- Failed to connect to a remote computer through Remote Desktop
- Credentials Not Work
- Windows instance: no remote Desktop license server can provide license
- Remote Login Failure Due To Port Issues
- Linux Instance Login Failures
- Linux Instance Login Failures
- Unable to Log in to a Linux Instance via SSH Key
- Failing to log in to a Linux CVM due to high CPU and memory usage
- Remote Login Failure due to Port Issues
- VNC Login Error (Module is Unknown)
- VNC Login Error (Account Locked due to XXX Failed Logins)
- VNC Login Error (Login Failed with Correct Password)
- VNC or SSH Login Error (Permission Denied)
- Login Failure Due to /etc/fstab Configuration Errors
- sshd Configuration File Permissions
- Infinite Loop Call in /etc/profile
- Login Failure Due to Server Isolation
- Login Failure Due to High Bandwidth Occupation
- Remote Connect Failure Due to Security Group Settings
- Troubleshooting Linux Instance Issues via VNC and Rescue Mode
- Failed to shut down or restart a CVM
- Network Namespace Creation Failure
- Kernel and IO Issues
- Missing System bin or lib Soft Link
- Suspected Infection with Virus
- "no space left on device" Error During File Creation
- Linux CVM Memory Issues
- Network Related Failures
- Instance-Related Failures
- API Documentation
- History
- Introduction
- API Category
- Region APIs
- Instance APIs
- RunInstances
- DescribeInstances
- DescribeInstanceFamilyConfigs
- DescribeInstancesOperationLimit
- InquiryPriceRunInstances
- InquiryPriceResetInstance
- InquiryPriceResetInstancesType
- StartInstances
- RebootInstances
- StopInstances
- ResizeInstanceDisks
- ResetInstancesPassword
- ModifyInstancesAttribute
- EnterRescueMode
- ExitRescueMode
- InquirePricePurchaseReservedInstancesOffering
- InquiryPriceResizeInstanceDisks
- TerminateInstances
- ModifyInstancesProject
- ResetInstancesType
- DescribeInstancesStatus
- DescribeReservedInstancesConfigInfos
- DescribeZoneInstanceConfigInfos
- PurchaseReservedInstancesOffering
- ResetInstance
- DescribeInstanceTypeConfigs
- DescribeInstanceVncUrl
- Cloud Hosting Cluster APIs
- Image APIs
- Instance Launch Template APIs
- Making API Requests
- Placement Group APIs
- Key APIs
- Security Group APIs
- Network APIs
- Data Types
- Error Codes
- FAQs
- Related Agreement
- Glossary
- Tutorial
- Release Notes and Announcements
- Release Notes
- Public Image Release Notes
- Announcements
- Temporary Solution for the Windows Blue Screen Issue Caused by CrowdStrike Security Software on July 19, 2024
- Announcement on Flexible Discounts for Spot Instances in Some Regions
- Updating Some Image Pip Package Management Tools for CentOS 7
- CentOS 8 End of Maintenance
- Discontinuation of Support for SUSE Commercial Images
- Price Reduction in Selected Availability Zones
- OrcaTerm Proxy IP Addresses Updates
- Pay-as-you-go Price Adjustments for Standard S3 CVMs in the Silicon Valley Region
- Vulnerability repairing for Linux images
- Stopping supporting for Ubuntu 10.04 images
- Solution to Tomcat Start Failure on Ubuntu14.04
- Upgrading Virtio network card drive for Windows CVMs
- About Configuration of Security Group Port 53
- Windows Server 2003 System Images End of Support Announcement
- End of Support for Windows Server 2008 R2 Enterprise Edition SP1 64-bit System Images
- Product Introduction
- Purchase Guide
- Getting Started
- Operation Guide
- Operation Guide Overview
- Use Limits
- Convenience Features
- Instances
- Creating Instances
- Managing Instance Launch Template
- Batch Sequential Naming or Pattern String-Based Naming
- Logging In to Linux Instances
- Logging in to Windows instance
- Adjusting Configuration
- View Instance Details
- Renaming Instances
- Resetting Instance Password
- Managing Instance IPs
- Changing Security Group
- Conversion from Pay-As-You-Go to Monthly Subscription
- Searching for Instances
- Exporting Instance List
- Renewing Instances
- Starting Up Instances
- Shutting Down Instances
- Restarting Instances
- Reinstalling System
- Using Tencent Cloud Automation Tools to execute commands
- Terminating/Returning Instances
- Enabling Instance Termination Protection
- Instance Repossession or Recovering
- Spot Instances
- Querying the Repossession Status of a Spot Instance
- No Charges When Shut Down for Pay-as-You-Go Instances
- Managing Roles
- Enabling and Disabling Hyper-Threading
- Reserved Instances
- Images
- Migrating Servers
- Maintenance Tasks
- Cloud Disks
- Networking
- Security
- Security Groups
- Protection of Sensitive Operations
- Managing Login Password
- Managing SSH Keys
- Spread Placement Group
- Unblocking Port 25
- Tags
- Monitoring and Alarms
- Sample Console Configuration
- Practical Tutorial
- Best Practices
- Choosing the CVM Model
- Setting up a Website
- Building an Environment
- Building a Website
- Building an Application
- Sending Emails through Port 465
- Building a Visual GUI
- Data Backup
- Uploading Local Files to CVM
- Copying Local Files to CVMs
- Uploading Files from Windows to a Windows CVM via MSTSC
- Uploading Files from MacOS to Windows CVM Using MRD
- Uploading Files from Linux to Windows CVM using RDP
- Uploading files via WinSCP to a Linux CVM from Windows
- Uploading Files from Linux or MacOS to Linux CVM via SCP
- Uploading Files from Linux to a CVM Using FTP
- Uploading Files from Windows to a CVM Using FTP
- Other CVM Operations
- CVM Access to COS via a Private Network
- Best Practices for Boot Mode Legacy BIOS and UEFI
- Recovering Data on Linux CVMs
- Managing Disk Space on Windows CVMs
- Changing Kernel of a Linux Instance Manually
- Setting Up Windows-based AD Domain on a CVM
- Network Performance Test
- High-throughput Network Performance Test
- Using USB/IP to Share USB Devices in Linux
- Using RemoteFx to Redirect USB Devices in Windows
- Using AVX-512 Instructions to Accelerate AI Applications on CVM
- Building Tencent SGX Confidential Computing Environment
- Configuring Persistent Memory in M6p Instances
- Calling Cloud APIs via Python to Share Custom Images in Batches
- Customizing DNS Configuration (Linux System)
- Operations Guide
- Initializing Data Disks
- Environment Configurations
- Installing Software
- User Data
- Work with Operating Systems
- System Activation
- System Updates
- System Shutdown
- Configuring High-performance Power Management
- Windows Recovery Mode
- Updating the Virtio ENI Driver
- Modifying SID
- Modifying VNC Resolution
- Ensuring Unique SIDs for CVMs Using Sysprep
- Use of the atop Monitoring Tools by Linux Instances
- Introduction to Linux Kernel Parameters
- Others
- Troubleshooting
- Instance-Related Failures
- CVM Login Failures
- Windows Instance Login Failures
- Windows Instance Login Failures
- An authentication error occurred when you tried to log in to a Windows instance remotely
- Failed to Reset the CVM Password or the CVM Password Is Invalid
- Connection to a Windows CVM through Remote Desktop was denied
- Requires network-level identity verification
- Problems occurred when you tried to log in to a Windows CVM remotely on Mac
- Failed to log in to a Windows CVM due to high CPU and memory usage
- Failed to connect to a remote computer through Remote Desktop
- Credentials Not Work
- Windows instance: no remote Desktop license server can provide license
- Remote Login Failure Due To Port Issues
- Linux Instance Login Failures
- Linux Instance Login Failures
- Unable to Log in to a Linux Instance via SSH Key
- Failing to log in to a Linux CVM due to high CPU and memory usage
- Remote Login Failure due to Port Issues
- VNC Login Error (Module is Unknown)
- VNC Login Error (Account Locked due to XXX Failed Logins)
- VNC Login Error (Login Failed with Correct Password)
- VNC or SSH Login Error (Permission Denied)
- Login Failure Due to /etc/fstab Configuration Errors
- sshd Configuration File Permissions
- Infinite Loop Call in /etc/profile
- Login Failure Due to Server Isolation
- Login Failure Due to High Bandwidth Occupation
- Remote Connect Failure Due to Security Group Settings
- Troubleshooting Linux Instance Issues via VNC and Rescue Mode
- Failed to shut down or restart a CVM
- Network Namespace Creation Failure
- Kernel and IO Issues
- Missing System bin or lib Soft Link
- Suspected Infection with Virus
- "no space left on device" Error During File Creation
- Linux CVM Memory Issues
- Network Related Failures
- Instance-Related Failures
- API Documentation
- History
- Introduction
- API Category
- Region APIs
- Instance APIs
- RunInstances
- DescribeInstances
- DescribeInstanceFamilyConfigs
- DescribeInstancesOperationLimit
- InquiryPriceRunInstances
- InquiryPriceResetInstance
- InquiryPriceResetInstancesType
- StartInstances
- RebootInstances
- StopInstances
- ResizeInstanceDisks
- ResetInstancesPassword
- ModifyInstancesAttribute
- EnterRescueMode
- ExitRescueMode
- InquirePricePurchaseReservedInstancesOffering
- InquiryPriceResizeInstanceDisks
- TerminateInstances
- ModifyInstancesProject
- ResetInstancesType
- DescribeInstancesStatus
- DescribeReservedInstancesConfigInfos
- DescribeZoneInstanceConfigInfos
- PurchaseReservedInstancesOffering
- ResetInstance
- DescribeInstanceTypeConfigs
- DescribeInstanceVncUrl
- Cloud Hosting Cluster APIs
- Image APIs
- Instance Launch Template APIs
- Making API Requests
- Placement Group APIs
- Key APIs
- Security Group APIs
- Network APIs
- Data Types
- Error Codes
- FAQs
- Related Agreement
- Glossary
Security groups can manage the access to CVMs. You can configure inbound and outbound rules for security groups to specify whether your server can be accessed by or can access other network resources.
The default inbound and outbound rules for security groups are as follows:
To ensure data security, the inbound rule for a security group is a rejection policy that forbids remote access from external networks. To enable public access to your CVM, you need to open the corresponding port to the Internet in the inbound rule.
The outbound rule for a security group specifies whether your CVM can access external network resources. If you select Open all ports or Open ports 22, 80, 443, and 3389 and the ICMP protocol, the outbound rule for the security group opens all ports to the Internet. If you select a custom security group rule, the outbound rule blocks all ports by default, and you need to configure the outbound rule to open the corresponding port to the Internet.
Common Use Cases
This document provides several common use cases of security groups. You can directly use its recommended security group configurations if a use case meets your requirements.
Scenario 1: remotely connecting to a Linux CVM via SSH
Case: you have created a Linux CVM and want to remotely connect to it via SSH.
Solution: when adding a security group rule, set Type to Login Linux CVMs(22), enter WebShell proxy IP address for Source, and open TCP port 22 to the Internet to enable Linux login via SSH.
You can open all IP addresses or a specified IP address (or IP range) to the Internet as required. This allows you to configure the source IP addresses of the CVMs that can be remotely connected to through SSH.
Direction | Type | Source | Protocol Port | Policy |
Inbound | Linux login | All IP addresses: 0.0.0.0/0 WebShell proxy IP addresses: as detailed in Orcaterm Proxy IP Addresses Updates Specified IP address: enter your specified IP address or IP range | TCP:22 | Allow |
Scenario 2: remotely connecting to a Windows CVM through RDP
Case: you have created a Windows CVM and want to remotely connect to it by using Remote Desktop (RDP).
Solution: when adding a security group rule, set Type to Login Windows CVMs(3389), enter the WebRDP proxy IP addresses for Source, and open TCP port 3389 to the Internet to enable remote login to Windows.
You can open all IP addresses or a specified IP address (or IP range) to the Internet as required. This enables you to configure the source IP addresses of the CVMs that can be remotely connected to via RDP.
Direction | Type | Source | Protocol Port | Policy |
Inbound | Windows login | All IP addresses: 0.0.0.0/0 WebRDP proxy IP addresses: 81.69.102.0/24 106.55.203.0/24 101.33.121.0/24 101.32.250.0/24 Specified IP address: enter your specified IP address or IP range | TCP:3389 | Allow |
Scenario 3: pinging a CVM on the Internet
Case: you have created a CVM and want to test whether its communication with other CVMs is normal.
Solution: test the connection by using the
ping command. Specifically, when adding a security group rule, set Type to Ping and open Internet Control Message Protocol (ICMP) ports to the Internet to enable other CVMs to access this CVM through ICMP.
You can open all IP addresses or a specified IP address (or IP range) to the Internet as required. This allows you to configure the source IP addresses of the CVMs that can access this CVM through ICMP.Direction | Type | Source | Protocol Port | Policy |
Inbound | Ping | All IP addresses: 0.0.0.0/0 Specified IP address: enter your specified IP address or IP range | ICMP | Allow |
Scenario 4: remotely logging in to a CVM through Telnet
Case: you want to remotely log in to a CVM by using Telnet.
Solution: when adding a security group rule, configure the following security group rule:
Direction | Type | Source | Protocol Port | Policy |
Inbound | Custom | All IP addresses: 0.0.0.0/0 Specified IP address: enter your specified IP address or IP range | TCP: 23 | Allow |
Scenario 5: allowing access to a web service through HTTP or HTTPS
Case: you have built a website and want to allow access to your website through HTTP or HTTPS.
Solution: when adding a security group rule, configure the following security group rules as required:
Allow all public IP addresses to access this website
Direction | Type | Source | Protocol Port | Policy |
Inbound | HTTP (80) | 0.0.0.0/0 | TCP: 80 | Allow |
Inbound | HTTPS (443) | 0.0.0.0/0 | TCP: 443 | Allow |
Allow some public IP addresses to visit this website.
Direction | Type | Source | Protocol Port | Policy |
Inbound | HTTP (80) | IP address or IP range that is allowed to access your website | TCP: 80 | Allow |
Inbound | HTTPS (443) | IP address or IP range that is allowed to access your website | TCP: 443 | Allow |
Scenario 6: allowing an external IP address to access a specified port
Case: you have deployed a service and want the specified service port (such as port 1101) to be externally accessible.
Solution: when adding a security group rule, set Type to Custom and open TCP port 1101 to the Internet to allow external access to the specified service port.
You can open all IP addresses or a specified IP address (or IP range) to the Internet as required. This allows the source IP address to access the specified service port.
Direction | Type | Source | Protocol Port | Policy |
Inbound | Custom | All IP addresses: 0.0.0.0/0 Specified IP address: enter your specified IP address or IP range | TCP: 1101 | Allow |
Scenario 7: rejecting an external IP address to access a specified port
Case: you have deployed a service and want to prevent external access to a specified service port (such as port 1102).
Solution: when adding a security group rule, set Type to Custom, configure the TCP port 1102, and set Policy to Reject, so that external services cannot access the specified service port.
Direction | Type | Source | Protocol Port | Policy |
Inbound | Custom | All IP addresses: 0.0.0.0/0 Specified IP address: enter your specified IP address or IP range | TCP: 1102 | Reject |
Scenario 8: allowing a CVM to access only a specified external IP address
Case: you want your CVM to access only a specified external IP address.
Solution: add two outbound security group rules as follows.
Allow the CVM instance to access a specified external IP address.
Forbid the CVM instance from accessing any public IP addresses via any protocol.
Note:
The first rule takes priority over the second.
Direction | Type | Source | Protocol Port | Policy |
Outbound | Custom | Specified public IP address that the CVM can access | Required protocol and port number | Allow |
Outbound | Custom | 0.0.0.0/0 | All | Reject |
Scenario 9: prohibiting a CVM from accessing a specified external IP address
Case: you do not want your CVM to access a specified external IP address.
Solution: add a security group rule as follows.
Direction | Type | Source | Protocol Port | Policy |
Outbound | Custom | Specified public IP address that your CVM instance cannot access | All | Reject |
Scenario 10: uploading or downloading a file from a CVM through FTP
Case: you want to allow uploads and downloads over FTP.
Solution: add a security group rule as follows.
Direction | Type | Source | Protocol Port | Policy |
Inbound | Custom | 0.0.0.0/0 | TCP: 20 to 21 | Allow |
Multi-scenario Configurations
You can configure multiple security group rules to meet your business requirements. For example, both inbound and outbound runes can be simultaneously configured. A CVM instance can be bound to one or multiple security groups. When it is bound to multiple security groups, the security group rules will be matched sequentially from top to bottom. You can adjust the priorities of security groups at any time. For more information about the priorities, see Rule Priorities.
Yes
No
Was this page helpful?