Security Group Use Cases

Security group settings are used to manage whether the Cloud Virtual Machine can be accessed. You can configure the inbound and outbound rules of the security group to set whether your server can be accessed and can access other network resources.
By default, the inbound and outbound rules for security groups are as follows:

• To ensure the data security, the input rules for security groups are set to a denial policy, prohibiting remote access from external networks. If you need your Cloud Virtual Machine to be accessible from the outside, you need to open the appropriate ports for inbound rules.
• The outbound rules for security groups are used to determine whether your Cloud Virtual Machine can access external network resources. If you select Open All Ports or Open 22, 80, 443, 3389 Ports and ICMP Protocol, the outbound rules for the security groups are fully open. If you opt for custom security group rules, the default outbound rule is to deny all, requiring you to open the relevant ports for outbound rules to access external network resources.

Common Use Cases

This document describes several common use cases for security groups. If any of the following scenarios meet your requirements, you can set your security groups according to the configuration recommended for the corresponding use case.

Scenario 1: remotely connecting to a Linux CVM through SSH

Example: You have created a Linux Cloud Virtual Machine and want to remotely connect to it through SSH.
Solution : When adding the security group rules, select Linux Log-in in the Type, open protocol port 22, allowing Linux SSH log-in.
You can also open all IPs or specified IPs (IP range) according to actual needs, and configure the IP source that can remotely connect to the Cloud Virtual Machine through SSH.

Scenario 2: remotely connecting to a Windows CVM through RDP

Example: You have created a Windows Cloud Virtual Machine and want to remotely connect to it through RDP.
Solution: When adding the security group rules, select Windows Log-in in the Type, open protocol port 3389, allowing Windows remote log-in.
You can also open all IPs or specified IPs (IP range) according to actual needs, and configure the IP source that can remotely connect to the Cloud Virtual Machine through SSH.

Scenario 3: pinging a CVM from the public network

Example: You have created a Cloud Virtual Machine and wish to test if the communication between this CVM and other CVMs is functioning correctly.
Solution: use the ping program for testing. That is, when adding security group rules, select Ping as the Type, open the ICMP protocol port, allowing other CVMs to access the CVM via ICMP protocol.
You can also open all IPs or specified IPs (IP range) according to actual needs, configuring the IP source allowed to access this Cloud Virtual Machine via ICMP protocol.

Scenario 4: Telnet remote log-in

Example: You wish to remotely log in to your Cloud Virtual Machine through Telnet.
Solution: If you need to remotely log in to the CVM through Telnet, configure the following security group rules when adding security group rules:

Scenario 5: allowing Web Service HTTP or HTTPS Access

Example: You have set up a website and want users to access it via HTTP or HTTPS.
Solution: To allow website access via HTTP or HTTPS, you need to add security group rules based on your needs, configuring the following security group rules:

• Allow all IPs on the public network to access the website

• Allow some IPs on the public network to access the website

Scenario 6: allowing external IPs to access the specified port

Example: After deploying your service, you want a specific business port (e.g., 1101) to be accessible from outside.
Solution: When adding security group rules, select Custom in Type and open protocol port 1101, allowing external access to the specified business port.
You can also open all IPs or specified IPs (IP range) according to actual needs, allowing access from IPs to the specified business port.

Scenario 7: denying external IPs to access the specified port

Example: After deploying your service, you want a specific business port (e.g., 1102) not to be accessible from outside.
Solution: When adding security group rules, select Custom in Type, configure protocol port 1102, and set the Policy to Deny to deny external access to the specified business port.

Scenario 8: allowing a Cloud Virtual Machine access to a specified external IP only

Example:You want your Cloud Virtual Machine to access only specific external IP addresses.
Solution: refer to the following configuration, adding these two outbound security group rules.

• Allow instances to access specific public IP addresses
• Prohibit the instance from accessing all public IP addresses with any protocol
  Note:

  The rule that permits access should have a higher priority than the rule that denies access.

Scenario 9: denying a Cloud Virtual Machine access to a specified external IP

Example:You don't want your Cloud Virtual Machine to access specific external IP addresses.
Solution: refer to the following configuration, adding security group rules.

Scenario 10: using FTP to upload or download files

Example:You need to use FTP software to upload or download files to or from Cloud Virtual Machine
Solution: refer to the following configuration, adding security group rules.

Combination of Multiple Scenarios

In practical scenarios, you may need to configure multiple security group rules based on business needs. For instance, setting up both inbound and outbound rules. One Cloud Virtual Machine can be bind to one or more security groups. When a Cloud Virtual Machine is bind to multiple security groups, these groups will be matched and executed in order from top to bottom. You can adjust the priority of the security groups at any time. For an explanation of the priority of security group rules, see Rule Priority Explanation.