Help Center/ Scalable File Service/ User Guide (ME-Abu Dhabi Region)/ FAQs/ Networks/ Does the Security Group of a VPC Affect SFS?
Updated on 2022-02-22 GMT+08:00

Does the Security Group of a VPC Affect SFS?

A security group is a collection of access control rules for ECSs that have the same security protection requirements and are mutually trusted in a VPC. After a security group is created, you can create different access rules for the security group to protect the ECSs that are added to this security group. The default security group rule allows all outgoing data packets. ECSs in a security group can access each other without the need to add rules. The system creates a security group for each cloud account by default. Users can also create custom security groups by themselves.

When creating the security group, you need to add the inbound and outbound access rule, and enable the ports needed by the NFS protocol and DNS server of SFS to ensure that the file system can be successfully mounted. The port numbers required by the NFS protocol are 111, 2049, 2050, 2051, 20048, and 2052. The port number required by the DNS server is 53.

Example Value

  • Inbound rule

    Direction

    Protocol

    Port Range

    Source IP Address

    Description

    Inbound

    TCP and UDP

    111

    IP Address

    0.0.0.0/0 (configurable)

    One port corresponds to one access rule. You need to add information to the ports one by one.

  • Outbound rule

    Direction

    Protocol

    Port Range

    Source IP Address

    Description

    Outbound

    TCP and UDP

    111

    IP Address

    0.0.0.0/0 (configurable)

    One port corresponds to one access rule. You need to add information to the ports one by one.

    The bidirectional access rule must be configured for port 111. The inbound rule can be set to the front-end service IP range of SFS. You can obtain it by running the following command: ping File system domain name or IP address or dig File system domain name or IP address.

    For ports 2049, 2050, 2051, and 2052, only the outbound rule needs to be added, which is the same as the outbound rule of port 111.