Overview
Security groups are used to manage whether access requests from the public network or private network are allowed. For security reasons, the inbound direction of security groups often adopts a deny access policy. If you select Open All Ports template or Open 22, 80, 443, 3389 Ports and ICMP Protocol template when creating a security group, the system will automatically add security group rules for some communication ports based on the selected template type.
This document describes how to add security group rules to allow or forbid Cloud Virtual Machine instances in the security group to access the public network or private network.
Notes
- Security group rules support IPv4 security group rules and IPv6 security group rules.
- Open all ports already includes IPv4 and IPv6 security group rules.
Prerequisites
- You have created a security group. For detailed operations, see Create Security Group.
- You already know which public network or private network access requests need to be allowed or denied for the Cloud Virtual Machine instance.
Directions
- Log in to the Cloud Virtual Machine Console.
- In the left sidebar, click Security Group to enter the Security Group Management page.
- On the Security Group Management page, select Region and find the security group whose rules need to be set.
- In the row of the security group where rules need to be set, click Modify Rules in the Operation column.
- On the Security Group Rules page, click Inbound Rules and select any of the following methods to complete the operation according to actual needs.
The following operation uses Method 2: adding rules as an example.- Method 1: open all ports, is applicable to scenarios where ICMP protocol rules do not need to be set and operations can be completed through ports 22, 3389, ICMP, 80, 443, 20, 21.
- Method 2: adding a rule, is applicable to scenarios where multiple communication protocols need to be set, such as the ICMP protocol.
- In the Add Inbound pop-up window, set the rules.
The main parameters for adding a rule are as follows:- Type: the default value is Custom. You can also select other system rule templates, such as Windows log-in, Linux log-in, Ping, HTTP(80), or HTTPS(443).
- Source: the source (inbound rule) or destination (outbound rule) of traffic, specify one of the following options:
| Specified Source/Destination | Description |
|---|---|
| Single IPv4 address or IPv4 address range | Notation in CIDR (such as 203.0.113.0, 203.0.113.0/24 or 0.0.0.0/130618222416261120, where 0.0.0.0/130618222416261120 represents matching all IPv4 addresses) |
| Single IPv6 address or IPv6 address range | Notation in CIDR (such as FF05::B5, FF05:B5::/60, ::/130618222416261120 or 0::0/130618222416261120, where: ::/130618222416261120 or 0::0/130618222416261120 represents matching all IPv6 addresses). |
| Refer to the security group ID. You can reference the ID of following security groups: - current security group - other security group |
- The current security group represents the security group ID associated with the Cloud Virtual Machine. - The other security group represents another security group ID under the same item in the same area. Note: - Referencing a security group ID is an advanced feature that you can choose to use. The rules of the referenced security group will not be added to the current security group. - When configuring the security group rules, if you enter a security group ID in source/destination, it means that only the private network IP address of the Cloud Virtual Machine instance and Elastic Network Interface bound to this security group ID is used as the source/destination, excluding the public network IP address. |
| Reference an IP address object or IP address group object in the parameter template | - |
- Protocol Port: Enter the protocol type and port range or you can also reference the protocol port or protocol port group in the parameter template.
- Policy: the default value is Allow.
- Allow: Access requests of this port are allowed.
- Reject: Data packets will be discarded without any response.
- Notes: Custom, and a short description of the rule for easier management.
- Click Finish to complete adding the security group inbound rule.
- On the Security Group Rules page, click "Outbound Rules" and refer to Step 5 - Step 7 to complete adding outbound rules for the security group.