Backend CVM security group configuration instructions

Introduction to CVM security groups

The backend CVM instance of the CLB can perform access control through security group and act as a firewall.
You can associate one or more security groups with backend CVMs and add one or more rules to each security group to control traffic access permissions for different servers. You can modify the rules of a security group at any time, and the new rules will automatically apply to all instances associated with the security group. In virtual private cloud environment, you can also use network ACL to perform access control.

CVM security group configuration instructions

In the CVM security group, the Client IP and service port must be allowed.
If you use CLB to forward business traffic to CVM, to ensure the health check function, you need to make the following configuration on the CVM security group:

1. Public Network CLB: You need to allow access to the CLB VIP in the security group of the backend CVM. The CLB uses the VIP to detect the health status of the backend CVM.
2. Private Network CLB: CLB belongs to a VPC network. You need to allow access to the CLB VIP in the security group of the backend CVM (for health check).

CVM security group configuration example

The following example shows the configuration of the CVM security group when accessing the CVM through the CLB.

• Use Case 1:
  For public network CLB, the listener is configured as TCP:80 listener, the backend service port is 8080, and it is hoped that only Client IP (ClientA IP and ClientB IP) can access the CLB. The inbound rules of the backend server security group are configured as follows:

  ClientA IP + 8080 allow
  ClientB IP + 8080 allow
  CLB VIP    + 8080 allow
  0.0.0.0/130618222416261120  + 8080 drop
  

• Use Case 2:
  For public network CLB, the listener is configured as HTTP:80 listener, the backend service port is 8080, and it is hoped that normal access will be enabled for all client IP addresses. The inbound rules of the backend server security group are configured as follows:

  0.0.0.0/130618222416261120 + 8080 allow
  

• Use Case 3:
  For application-based private network CLB, the network type is VPC network. The VIP of CLB needs to be allowed in the security group of CVM for health check. Configure a TCP:80 listener for the CLB, and the backend service port is 8080. It is hoped that only Client IP (ClientA IP and ClientB IP) can be allowed to access the load-balanced VIP, and it is hoped that Client IP can only access the backend host bound to the CLB.

  1. The inbound rules of the backend server security group are configured as follows:

  ClientA IP + 8080 allow
  ClientB IP + 8080 allow
  CLB VIP    + 8080 allow
  0.0.0.0/130618222416261120  + 8080 drop
  

  2. The outbound rules of the server security group used as the Client are configured as follows:

  CLB VIP    + 8080 allow
  0.0.0.0/130618222416261120  + 8080 drop
  

• Use Case 4: blocklist
  If users need to set up a blocklist for certain client IP addresses to deny their access, they can do so by configuring the security group associated with the cloud service. The security group rules need to be configured as follows:

  3. Add the client IP + port to which access needs to be denied to the security group, and select Deny access to the IP in the Policy column.
  4. After the settings are completed, you can add a security group rule to open access to all IP addresses on this port by default.
     After the configuration is completed, the security group rules are as follows:

  clientA IP + port drop
  clientB IP + port drop
  0.0.0.0/130618222416261120  + port accept
  

  Note:

  • The above configuration steps have order requirements. The opposite order will cause the blocklist configuration to fail.

• Security groups are stateful, so the above configurations are all for inbound rules. No special configuration is required for outbound rules.

CVM security group operation guide

Managing backend server security groups using the console

1. Log in to the CLB console and click the corresponding CLB instance ID to enter the CLB details page.
2. On the CLB-bound CVM page, click the corresponding backend server ID to enter the CVM details page.
3. Click the Security Group tab to bind/unbind the security group.