Backend CVM security group configuration instructions

Introduction to CVM security groups

The backend CVM instance of the CLB can perform access control through security group and act as a firewall.
You can associate one or more security groups with backend CVMs and add one or more rules to each security group to control traffic access permissions for different servers. You can modify the rules of a security group at any time, and the new rules will automatically apply to all instances associated with the security group. In virtual private cloud environment, you can also use network ACL to perform access control.

CVM security group configuration instructions

In the CVM security group, the Client IP and service port must be allowed.
If you use CLB to forward business traffic to CVM, to ensure the health check function, you need to make the following configuration on the CVM security group:

1. Public Network CLB: You need to allow access to the CLB VIP in the security group of the backend CVM. The CLB uses the VIP to detect the health status of the backend CVM.
2. Private Network CLB: CLB belongs to a VPC network. You need to allow access to the CLB VIP in the security group of the backend CVM (for health check).

CVM security group configuration example

The following example shows the configuration of the CVM security group when accessing the CVM through the CLB.

• Use case 1:
  Public network CLB. The listener is configured as TCP:80 and the backend service port is 8080. To allow only specific client IP addresses (ClientA IP address and ClientB IP address) to access the CLB instance, configure the inbound rules for the backend server security group as follows:

  ClientA IP + 8080 allow
  ClientB IP + 8080 allow
  CLB VIP    + 8080 allow
  0.0.0.0/130618222416261120  + 8080 drop
  

• Use case 2:
  Public network CLB. The listener is configured as HTTP:80 and the backend service port is 8080. To allow normal access from all client IP addresses, configure the inbound rules for the backend server security group as follows:

  0.0.0.0/130618222416261120 + 8080 allow
  

• Use case 3:
  Application-based private network CLB. The network type is VPC, and the CVM security group should allow traffic from the CLB instance VIP for health check. A TCP:80 listener is configured for the CLB instance, with the backend service port set to 8080. The goal is to allow only specific client IP addresses (ClientA IP address and ClientB IP address) to access the CLB instance VIP, and also restrict the client IP addresses to only access the backend hosts bound to the CLB instance.

  1. The inbound rules of the backend server security group are configured as follows:

  ClientA IP + 8080 allow
  ClientB IP + 8080 allow
  CLB VIP    + 8080 allow
  0.0.0.0/130618222416261120  + 8080 drop
  

  2. The outbound rules of the server security group used as the Client are configured as follows:

  CLB VIP    + 8080 allow
  0.0.0.0/130618222416261120  + 8080 drop
  

• Use case 4: blocklist
  If you need to configure a blocklist for certain client IP addresses to deny their access, you can achieve this by configuring the security group associated with the cloud service. The security group rules need to be configured as follows:
  1.1. Add the client IP address and port that need to be denied access to the security group, and select the option to deny access from that IP address in the policy section.
  1.2. After completing the settings, add another security group rule to allow access from all IP addresses on this port by default.
  After the configuration is complete, the security group rules are as follows:

  clientA IP + port drop
  clientB IP + port drop
  0.0.0.0/130618222416261120  + port accept
  

  Note:

• The above configuration steps need to be performed in a specific order. Reversing the order will cause the blocklist configuration to fail.
• Security groups are stateful. Therefore, the above configurations are all for inbound rules, and no special configuration is required for outbound rules.

CVM security group operation guide

Managing backend server security groups using the console

1. Log in to the CLB console and click the corresponding CLB instance ID to enter the CLB details page.
2. On the CLB-bound CVM page, click the corresponding backend server ID to enter the CVM details page.
3. Click the Security Group tab to bind/unbind the security group.