Security Group and Network ACL Rules

Scenarios

To ensure normal communications between the load balancer and backend servers, you need to check the security group and network ACL rules.

• Security group rules of backend servers must allow traffic from the backend subnet where the load balancer is created to the backend servers. (By default, the backend subnet of a load balancer is the same as the subnet where the load balancer works.) For details about how to configure security group rules, see Configuring Security Group Rules for Backend Servers.

• Network ACL rules are optional for subnets. If network ACL rules are configured for the subnet where the backend servers are deployed, the rules must allow traffic from the backend subnet of the load balancer to the subnet of the backend servers. For details about how to configure network ACL rules, see Configuring Network ACL Rules.

If a dedicated load balancer has Layer 4 listeners and IP as a backend is disabled, security group and network ACL rules will be ignored even if you have configured rules to allow traffic.

You can use access control to limit which IP addresses are allowed or denied to access the listener. For details, see What Is Access Control?

Constraints

• If health check is enabled for a backend server group, security group rules must allow traffic over the health check port and protocol.
• If UDP is used for health check, there must be a rule that allows ICMP traffic to check the health of the backend servers.

Default Security Group Rules

Figure 1 Default security group

Table 1 describes the default rules for the default security group.

Requirements on the Security Group Rules of Backend Servers

Configuring Security Group Rules for Backend Servers

By default, a VPC security group allows instances in it to communicate with each other and access external networks, but it denies access from external networks. To ensure that the load balancer can communicate with backend servers over both the listener port and health check port, you need to configure inbound security group rules to allow inbound traffic to backend servers over both ports.

1. Log in to the ECS console.
2. In the ECS list, click the name of the target ECS.

   The ECS details page is displayed.

3. Click the Security Groups tab, locate the security group, click its name, and view security group rules.
4. On the Inbound Rules tab, click Add Rule. Configure inbound rules based on Requirements on the Security Group Rules of Backend Servers.
   

   • After a load balancer is created, do not change the subnet. If the subnet is changed, the IP addresses occupied by the load balancer will not be released, and traffic from the previous backend subnet to backend servers still needs to be allowed.
   • Traffic from the new backend subnet also needs to be allowed to backend servers.
5. Click OK.

Configuring Network ACL Rules

To control traffic in and out of a subnet, you can associate a network ACL with the subnet. Network ACL rules control access to subnets and add an additional layer of defense to your subnets.

Default network ACL rules deny all inbound and outbound traffic. You can configure inbound rules to allow traffic from the backend subnet of the load balancer over the ports of backend servers.

• If the load balancer is in the same subnet as the backend servers, network ACL rules will not take effect. In this case, the backend servers will be considered healthy and can be accessed by the clients.
• If the load balancer is not in the same subnet as the backend servers, network ACL rules will take effect. In this case, the backend servers will be considered unhealthy and cannot be accessed by the clients.

1. Go to the network ACL list page.
2. In the network ACL list, locate the target network ACL and click its name.
3. On the Inbound Rules or Outbound Rules tab, click Add Rule to add inbound or outbound rules.
   • Action: Select Allow.
   • Type: Select the same type as the backend subnet of the load balancer.
   • Protocol: The protocol must be the same as the backend protocol.
   • Source: Set it to the backend subnet of the load balancer.
   • Source Port Range: Select a port range.
   • Destination: Enter a destination address allowed in this direction. The default value is 0.0.0.0/0, which indicates that traffic to all IP addresses is permitted.
   • Destination Port Range: Select a port range.
   • (Optional) Description: Describe the network ACL rule.
4. Click OK.