Configuring Security Group Rules for a FlexusL Instance

Scenarios

A security group consists of inbound and outbound rules. You can add security group rules to allow or deny the traffic to reach and leave the FlexusL instances in the security group.

Security group rules allow or deny network traffic from specific sources over specific protocols or specific ports.

• For details about configuration examples, see Security Group Examples.
• For details about how to configure security group rules for FlexusL application images, see Configuring Security Groups for FlexusL Application Images.

Precautions

• Before configuring security group rules, you need to plan rules for communications among instances in the security group.
• Define simple security group rules. For details about the constraints on the number of rules in a security group, see Notes and Constraints.
• After allowing traffic over a port in a security group rule, ensure that the port is opened in the instance. For details, seeVerifying Security Group Rules
• Generally, all FlexusL instances created by the same account in the same region are in the same security group and they can communicate with each other by default.

Procedure

1. Log in to the FlexusL console and click a resource card to go to the instance details page.
2. In the navigation pane on the left, choose Cloud Servers and then click the server name.
3. On the Security Groups tab, select Inbound rules and click Add Rule.
   You can click + to add more inbound rules.

   Figure 1 Adding an inbound rule
   

   Table 1 Inbound rule parameter description

   Parameter	Description	Example Value
   Priority	The security group rule priority. The priority value ranges from 1 to 100. The default value is 1 and has the highest priority. The security group rule with a smaller value has a higher priority.	1
   Action	The value can be Allow or Deny. If the Action is set to Allow, access from the source is allowed to ECSs in the security group over specified ports. If the Action is set to Deny, access from the source is denied to ECSs in the security group over specified ports. Security group rules are matched by priority and then by action. Deny rules take precedence over allow rules. For more information, see How Traffic Matches Security Group Rules.	Allow
   Type	Source IP address version. You can select: IPv4 IPv6	IPv4
   Protocol & Port	The network protocol used to match traffic in a security group rule. The protocol can be All, TCP, UDP, GRE, or ICMP.	TCP
   	Destination port used to match traffic in a security group rule. The value can be from 1 to 65535. Inbound rules control incoming traffic over specific ports to instances in the security group. Specify one of the following: Individual port: Enter a port, such as 22. Consecutive ports: Enter a port range, such as 22-30. Non-consecutive ports: Enter ports and port ranges, such as 22,23-30. You can enter a maximum of 20 ports and port ranges. Each port range must be unique. All ports: Leave it empty or enter 1-65535.	22, or 22-30
   Source	Used to match the IP address or address range of an external request. The source can be: IP address: You can enter multiple IP addresses, separated by commas (,). Each IP address defines a different security group rule. Single IP address: IP address/mask Example IPv4 address: 192.168.10.10/32 Example IPv6 address: 2002:50::44/128 IP address range in CIDR notation: IP address/mask Example IPv4 address range: 192.168.52.0/24 Example IPv6 address range: 2407:c080:802:469::/64 All IP addresses 0.0.0.0/0 represents all IPv4 addresses. ::/0 represents all IPv6 addresses. Security group: The source is from another security group. You can select a security group in the same region from the drop-down list. If there is instance A in security group A and instance B in security group B, and the inbound rule of security group A allows traffic from security group B, traffic is allowed from instance B to instance A. IP address group: An IP address group is a collection of one or more IP addresses. You can select an available IP address group from the drop-down list. An IP address group can help you manage IP address ranges and IP addresses with same security requirements in an easier way. If no IP address groups are available, create one by referring to Creating an IP Address Group.	IP address: 192.168.52.0/24,10.0.0.0/24
   Description	Supplementary information about the security group rule. This parameter is optional. The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).	N/A

4. On the Security Groups tab page, select Outbound rules and click Add Rule.

   You can click + to add more outbound rules.

   Table 2 Outbound rule parameter description

   Parameter	Description	Example Value
   Priority	The security group rule priority. The priority value ranges from 1 to 100. The default value is 1 and has the highest priority. The security group rule with a smaller value has a higher priority.	1
   Action	The value can be Allow or Deny. If the Action is set to Allow, access from ECSs in the security group is allowed to the destination over specified ports. If the Action is set to Deny, access from ECSs in the security group is denied to the destination over specified ports. Security group rules are matched by priority and then by action. Deny rules take precedence over allow rules. For more information, see How Traffic Matches Security Group Rules.	Allow
   Type	Destination IP address version. You can select: IPv4 IPv6	IPv4
   Protocol & Port	The network protocol used to match traffic in a security group rule. The protocol can be All, TCP, UDP, GRE, or ICMP.	TCP
   	Destination port used to match traffic in a security group rule. The value can be from 1 to 65535. Outbound rules control outgoing traffic over specific ports from instances in the security group. Specify one of the following: Individual port: Enter a port, such as 22. Consecutive ports: Enter a port range, such as 22-30. Non-consecutive ports: Enter ports and port ranges, such as 22,23-30. You can enter a maximum of 20 ports and port ranges. Each port range must be unique. All ports: Leave it empty or enter 1-65535.	22, or 22-30
   Destination	Used to match the destination address of an internal request. The destination can be: IP address: You can enter multiple IP addresses, separated by commas (,). Each IP address defines a different security group rule. Single IP address: IP address/mask Example IPv4 address: 192.168.10.10/32 Example IPv6 address: 2002:50::44/128 IP address range in CIDR notation: IP address/mask Example IPv4 address range: 192.168.52.0/24 Example IPv6 address range: 2407:c080:802:469::/64 All IP addresses 0.0.0.0/0 represents all IPv4 addresses. ::/0 represents all IPv6 addresses. Security group: The destination is from another security group. You can select a security group in the same region under the current account from the drop-down list. If there is instance A in security group A and instance B in security group B, and the outbound rule of security group A allows traffic to security group B, traffic is allowed from instance A to instance B. IP address group: An IP address group is a collection of one or more IP addresses. You can select an available IP address group from the drop-down list. An IP address group can help you manage IP address ranges and IP addresses with same security requirements in an easier way. If no IP address groups are available, create one by referring to Creating an IP Address Group.	IP address: 192.168.52.0/24,10.0.0.0/24
   Description	Supplementary information about the security group rule. This parameter is optional. The security group rule description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).	N/A

5. Click OK.

Verifying Security Group Rules

After inbound and outbound rules are added, you can verify whether the rules take effect. Suppose you have deployed a website on a FlexusL instance server. To allow your users to access your website over port 80 (HTTP), you add a security group rule shown in Table 3.

Linux servers

To verify the security group rule on a Linux server:

1. Log in to the server.
2. Run the following command to check whether TCP port 80 is listened:

   netstat -an | grep 80

   If command output shown in Figure 2 is displayed, TCP port 80 is listened.

   Figure 2 Command output for the Linux server
   
3. Enter http://EIP bound to the server in the address box of the browser and press Enter.

   If the requested page can be accessed, the security group rule has taken effect.

Related Operations

On the Inbound Rules and Outbound Rules tab pages, you can also modify, replicate, or delete existing rules.

Deleting security group rules will disable some functions.

• If you delete a rule with Protocol & Port specified as TCP: 20-21, you will not be able to upload files to or download them from servers using FTP.
• If you delete a rule with Protocol & Port specified as ICMP: All, you will not be able to ping the servers.
• If you delete a rule with Protocol & Port specified as TCP: 443, you will not be able to connect to websites on the servers using HTTPS.
• If you delete a rule with Protocol & Port specified as TCP: 80, you will not be able to connect to websites on servers using HTTP.
• If you delete a rule with Protocol & Port specified as TCP: 22, you will not be able to remotely connect to Linux server using SSH.