A security group is a virtual firewall used to set network access controls for instances such as cloud servers, load balancers, and cloud databases. It controls inbound and outbound traffic at the instance level and is an important means of network security isolation.
You can configure security group rules to allow or deny inbound and outbound traffic for instances within the security group.
Security group features
- A security group is a logical grouping where you can add instances such as cloud servers, elastic network interfaces, and cloud databases that have the same network security isolation requirements within the same region.
- Instances associated with the same security group do not communicate by default, and you need to add corresponding allow rules.
- Security groups are stateful; for inbound traffic that you have allowed, outbound traffic is automatically allowed, and vice versa.
- You can modify security group rules at any time, and new rules take effect immediately.
Security group rules
Components
Security group rules include the following components:
- Source: the source data (inbound) or destination data (outbound) IP.
- Protocol type and protocol port: Protocol types such as TCP, UDP, HTTP, etc.
- Policy: Allow or deny.
Rule Priority
- Rules within a security group have priorities. Rule priority is represented by the position of the rule in the list, with the highest priority rule at the top of the list and the lowest at the bottom.
- If there is a rule conflict, the rule with the higher priority will prevail by default.
- When traffic enters/exits an instance bind to a security group, it matches rules from the top to the bottom of the security group rule list. If a rule is successfully matched and allowed to pass, the subsequent rules will not be matched.
Multiple Security Groups
An instance can be bind to one or more security groups. When an instance is bind to multiple security groups, the rules of multiple security groups are executed sequentially from top to bottom, and you can adjust the priority of security groups at any time.
Security Group Template
When creating a new security group, you can choose from two security group templates provided by Converge Cloud:
- Allow all port templates: All inbound and outbound traffic will be allowed.
- Allow Common Ports Template: TCP port 22 (Linux SSH login), ports 80 and 443 (Web services), port 3389 (Windows remote log in), ICMP protocol (Ping), and internal network traffic will be allowed.Note:
- If the provided security group templates do not meet your actual needs, you can also create a custom security group. For details, please refer to Creating Security Groups and Security Group Use Cases.
- If you have security protection requirements at the application layer (HTTP/HTTPS), you can separately purchase Web Application Firewall (WAF). WAF provides application layer web security protection against web vulnerability attacks, malicious crawlers, and CC attacks, safeguarding websites and web applications.
Use Limits
For the usage restrictions and quotas of security groups, please see the security group-related restrictions chapter in Use Limits Overview.
Process Flow
The usage process for security groups is illustrated in the following diagram: