Port related
Why should I open a port, and how?
You need to open the port in the security group before you can use the service corresponding to the port. Example:
To access a webpage using port 8080, you need to open and allow this port in the security group settings. The steps to open a port are as follows:
- Log in to the security group console and click on the security group bind to the instance to enter the details page.
- Select inbound/outbound rules and click Add Rule.
- Enter your IP address (range) and the port information you need to open, then select Allow.
For detailed directions, see Adding Security Group Rules.
Why can't the service be used after modifying the port?
After modifying the service port, you also need to open the corresponding port in the corresponding security group, otherwise the service will not be available.
Which ports are not supported by the cloud platform?
The following ports pose security risks. Due to security considerations, the operator blocks them, resulting in inaccessible access. It is recommended to change the port and avoid using the following ports for listening:
| Protocol | Ports not supported |
|---|---|
| TCP | 42,135,137,138,139,445,593,1025,1434,1068,3127,3128,3129,3130,4444,5554,9996 |
| UDP | 1026、1027、1434、1068、5554、9996、1028、1433、135-139 |
Security group related
Why is there a default deny rule in the security group?
Security group rules are applied sequentially from top to bottom. After the preceding allow rules are matched, other rules are defaultly denied. If all ports are allowed through the rules, then this final deny rule will not take effect. For security reasons, we provide this default setting.
What impact does selecting the incorrect security group have on instances bind to it? How can this be resolved?
- Issue risks
- Remote connections (SSH) to Linux instances, and remote desktop logs-in to Windows instances, may fail.
- Remote ping to the public IP and private network IP of CVM instances under this security group may fail.
- HTTP access to web services exposed by instances under this security group may fail.
- Instances under this security group may experience failures when accessing Internet services.
- Solution
- If the above issues occur, you can reconfigure the security group rules in the console's security group management, for example: only bind the default allow-all security group.
- For specific security group settings, please refer to Security Group - Security Group Rules.
What are the direction and policy of security groups?
- The direction of security group policies is divided into outbound and inbound. Outbound direction refers to filtering the outbound traffic of cloud servers, while inbound direction refers to filtering the inbound traffic of cloud servers.
- Security group policies are divided into Allow and Deny traffic.
What is the order of effectiveness for security group policies?
The order of effectiveness for security group policies is from top to bottom. The matching order of traffic through security group policies is from top to bottom. Once a match is successful, the policy takes effect.
Why can IPs that are not allowed by the security group still access cloud servers?
There may be the following reasons:
- The CVM may be bind to multiple security groups, and the specific IP is allowed in other security groups.
- The specific IP belongs to approved Converge Cloud public services.
Does using a security group mean that iptables cannot be used?
No. Security groups and iptables can be used simultaneously. Your traffic will be filtered twice, and the traffic flow is as follows:
- Outbound direction: processes on the instance > iptables > security group.
- Inbound direction: security group > iptables > processes on the instance.
Is there cloud API support for cloning security groups across projects and regions?
For the convenience of console users, we currently provide console support, and there is no direct cloud API support. You can indirectly achieve the cloning of security groups across projects and regions through the existing cloud API for batch import and export of security group rules.
Will cloning security groups across projects and regions also copy the cloud servers managed by the security group?
No, when cloning security groups across regions, only the original security group's inbound and outbound rules are cloned, and cloud servers need to be associated separately.