Security group rules

Security group rules control the inbound traffic allowed to reach the instance associated with the security group and the outbound traffic allowed to leave the instance.

Security group rule content

• Type: Common application types, such as SSH, PING or HTTP, etc., with the option of customizing TCP or UDP.

• Protocol: Select by application type to display the type of protocol to which it belongs.

• Target Port:

  • If inbound rules are configured, the target port refers to the instance port within the security group; if outbound rules are configured, the target port refers to the remote port.
  • The port value is 1-65535 and can be filled with a single port such as "22" or a range of ports such as "20-22".
  • If you select Common Application in the rule type, the target port will be directly displayed as the corresponding default port without setting; if you select Custom TCP/Custom UDP, you can customize the port range.

• Source/Destination IP: IP address or address segment allowed to access/be accessed (CIDR), IPv4 address, e.g. fill in 0.0.0.0/0 means all IP addresses are allowed to access; Ipv6 address, e.g. fill in ::/0 means all IP addresses are allowed to access.

• Policy: Allow (default and no modification allowed).

• Notes: Marking rule usage, up to 256 characters can be entered.

Security Group Rule Restrictions

• User-created security groups have the following rules by default
  • Entry direction: Deny all traffic
  • Outward direction: Open TCP port 80 and UDP ports 67, 68 and 161 due to internal service needs, all other traffic is denied
• The security group rule policy is always "Allow"; you cannot create a rule to "Deny" access.
• Security groups are stateful: If you configure an outbound rule to allow an instance to send a request to the outside, the response traffic for that request will be allowed to flow regardless of the inbound security group rule, and vice versa.
• You can add and remove rules at any time. The new security group policy is automatically applied to the instance associated with the security group.

Common ports

Security Group Priority

Security groups have no priority, when an instance is associated with multiple security group associations, the rules of each security group will be aggregated to take effect, and access will be allowed or not according to the aggregated rules.

Related References

Connect Linux Instance

Connect Windows Instance