Security Group Use Cases

Security group settings are used to manage whether the Cloud Virtual Machine can be accessed. You can configure the inbound and outbound rules of the security group to set whether your server can be accessed and can access other network resources.
By default, the inbound and outbound rules for security groups are as follows:

• To ensure the data security, the input rules for security groups are set to a denial policy, prohibiting remote access from external networks. If you need your Cloud Virtual Machine to be accessible from the outside, you need to open the appropriate ports for inbound rules.
• The outbound rules for security groups are used to determine whether your Cloud Virtual Machine can access external network resources. If you select Open All Ports or Open 22, 80, 443, 3389 Ports and ICMP Protocol, the outbound rules for the security groups are fully open. If you opt for custom security group rules, the default outbound rule is to deny all, requiring you to open the relevant ports for outbound rules to access external network resources.

Common Use Cases

This document describes several common use cases for security groups. If any of the following scenarios meet your requirements, you can set your security groups according to the configuration recommended for the corresponding use case.

Scenario 1: remotely connecting to a Linux CVM through SSH

Example: You have created a Linux CVM and wish to connect to the CVM remotely via SSH.
Solution: When adding an inbound rule, select "Linux login" in the "Type", open port 22, and allow Linux SSH login.
You can also, based on actual requirements, allow all IPs or specified IPs (IP segments) to configure IP sources that can remotely connect to the CVM via SSH.

Scenario 2: remotely connecting to a Windows CVM through RDP

Example: You have created a Windows CVM and wish to connect to the CVM remotely via RDP.
Solution: When adding an inbound rule, select "Windows login" in the "Type", open port 3389, and allow Windows remote login.
You can also, based on actual requirements, allow all IPs or specified IPs (IP segments) to configure IP sources that can remotely connect to the CVM via RDP.

Scenario 3: pinging a CVM from the public network

Example: You created a CVM and wish to test whether the communication between this CVM and other CVMs is normal.
Solution: Use the ping program for testing. When adding an inbound rule, select "Ping" in the "Type", open the ICMP protocol port, and allow other CVMs to access this CVM through the ICMP protocol.
You can also, based on actual requirements, allow all IPs or specified IPs (IP segments) to configure IP sources that can access this CVM via the ICMP protocol.

Scenario 4: Telnet remote log-in

Example: You wish to log in to the CVM remotely via Telnet.
Solution: To log in to the CVM remotely via Telnet, you need to configure the following security group rules when adding an inbound rule:

Scenario 5: allowing Web Service HTTP or HTTPS Access

Example: You have set up a website and wish users to access the website via HTTP or HTTPS.
Solution: To allow access to the website via HTTP or HTTPS, you need to configure the following security group rules based on actual requirements when adding an inbound rule:

• Allow all IPs on the public network to access the website

• Allow some IPs on the public network to access the website

Scenario 6: allowing external IPs to access the specified port

Example: After deploying the service, you want the specified business port (e.g., 1101) to be accessible from the outside.
Solution: When adding inbound rules, select Custom in Type and open protocol port 1101, allowing external access to the specified business port IP. You can also open all IPs or specified IPs (IP range) according to actual needs, allowing access from IPs to the specified business port.

Scenario 7: denying external IPs to access the specified port

Example: After deploying the service, you do not want the specified business port (e.g., 1102) to be accessible from the outside.
Solution: When adding inbound rules, select Custom in Type, configure protocol port 1102, and set the Policy to Deny to deny external access to the specified business port.

Scenario 8: allowing a Cloud Virtual Machine access to a specified external IP only

Example: You want your CVM to access only specific external IP addresses.
Solution: Refer to the following configuration and add the following two outbound security group rules.

• Allow instances to access specific public IP addresses
• Prohibit the instance from accessing all public IP addresses with any protocol

  The rule that permits access should have a higher priority than the rule that denies access.

Scenario 9: denying a Cloud Virtual Machine access to a specified external IP

Example: You do not want your CVM to access specific external IP addresses.
Solution: Refer to the following configuration and add security group rules.

Scenario 10: using FTP to upload or download files

Example: You need to use FTP software to upload or download files to/from the Cloud Virtual Machine.
Solution: Refer to the following configuration and add security group rules.

Combination of Multiple Scenarios

In practical scenarios, you may need to configure multiple security group rules based on business needs. For instance, setting up both inbound and outbound rules. One Cloud Virtual Machine can be bind to one or more security groups. When a Cloud Virtual Machine is bind to multiple security groups, these groups will be matched and executed in order from top to bottom. You can adjust the priority of the security groups at any time. For an explanation of the priority of security group rules, see Rule Priority Explanation.