Overview
Security groups are used to manage whether access requests from the public network or private network are allowed. For security reasons, the inbound direction of security groups often adopts a deny access policy. If you select Open All Ports template or Open 22, 80, 443, 3389 Ports and ICMP Protocol template when creating a security group, the system will automatically add security group rules for some communication ports based on the selected template type. For details, see Product Overview.
This document describes how to add security group rules to allow or forbid Cloud Virtual Machine instances in the security group to access the public network or private network.
Notes
- Security group rules support IPv4 security group rules and IPv6 security group rules.
- Open all ports already includes IPv4 and IPv6 security group rules.
Prerequisites
- You have created a security group. For detailed operations, see Create Security Group.
- You already know which public network or private network access requests need to be allowed or denied for the Cloud Virtual Machine instance. For more use cases of security group rule settings, see Security Group Use Cases.
Directions
Log in to the CVM console.
In the left sidebar, click Security Group to enter the Security Group Management page.
On the Security Group Management page, select Region and find the security group whose rules need to be set.
In the row of the security group where rules need to be set, click Modify Rules in the Operation column.
On the Security Group Rules page, click Inbound Rules and select any of the following methods to complete the operation according to actual needs. > Note: The following operation uses Method 2: adding rules as an example.
- Method 1: open all ports, is applicable to scenarios where ICMP protocol rules do not need to be set and operations can be completed through ports 22, 3389, ICMP, 80, 443, 20, 21.
- Method 2: adding a rule, is applicable to scenarios where multiple communication protocols need to be set, such as the ICMP protocol.
In the pop-up Add Inbound Rules window, set the rules.
The main parameters for adding a rule are as follows:- Type: the default value is Custom. You can also select other system rule templates, such as Windows log-in, Linux log-in, Ping, HTTP(80), or HTTPS(443).
- Source: the source (inbound rule) or destination (outbound rule) of traffic, specify one of the following options:
| Specified Source/Destination | Description |
|---|---|
| Single IPv4 address or IPv4 address range | In CIDR notation, such as 203.0.113.0, 203.0.113.0/24 or 0.0.0.0/0, where 0.0.0.0/0 indicates all IPv4 addresses will be matched. |
| Single IPv6 address or IPv6 address range | In CIDR notation, such as FF05::B5, FF05:B5::/60, ::/0 or 0::0/0, where ::/0 or 0::0/0 indicates all IPv6 addresses will be matched. |
| Refer to the security group ID. You can reference the ID of following security groups: - Security group ID - other security group |
- The current security group indicates the CVM associated with the security group. - The other security group represents another security group ID under the same item in the same area. |
| Reference an IP address object or IP address group object in the Parameter Template. |
- Protocol Port: Enter the protocol type and port range or you can also reference the protocol port or protocol port group in the Parameter Template.
- Policy: the default value is Allow.
- Allow: Access requests of this port are allowed.
- Reject: Data packets will be discarded without any response.
- Notes: Custom, and a short description of the rule for easier management.
- Click Finish to complete adding the security group inbound rule.
- On the Security Group Rule page, click Outbound Rules and refer to step 5 - step 7 to complete adding the security group outbound rule.