Port
Which ports should I open before logging in to an instance?
Generally, you need to open port 22 for a Linux instance, or port 3389 for a Windows instance. For more information, see Application Cases of Security Groups.
Why should I open a port, and how?
You should open the port in the security group to use related services.
For example, if you want to access web pages using port 8080, you should open this port in the security group.
Steps to open a port:
1. Log in to the VPC console and select Security Group in the left sidebar. Click the ID/name of the security group bound with the instance to enter its details page.
2. Select "Inbound rules" or "Outbound rules", and click Add rule.
3. Enter your IP address (range) and information of the port you want to open, then select "Allow".
For details, see Adding Security Group Rules.
Why is my application not accessible after I modified the port?
After modifying the service port, you need to open the corresponding port in the security group.
What ports are not supported by Tencent Cloud?
The following ports are not allowed as they have security risks and are very likely to be blocked by ISPs.
Protocol | Unsupported ports |
TCP | 42、135、137、138、139、445、593、1025、1434、1068、3127、3128、3129、3130、4444、5554、5800、5900、9996 |
UDP | 1026、1027、1434、1068、5554、9996、1028、1433、135 - 139 |
I cannot connect to an external address through TCP port 25.
To enhance the quality of sending emails through Tencent Cloud’s IP addresses, CVMs are blocked from using TCP port 25 to connect to external addresses by default. To unblock this port, you can log in to the console, hover over the account navigation area at the top, and click Security Control to view the link for unblocking port 25.
Each account supports unblocking the CVMs 5 times. Note that pay-as-you-go CVMs are not supported.
Security Group
What if an improper security group is selected? How can this be fixed?
Risks
Fail to remotely connect to a Linux instance (SSH) or remotely log in to desktop Windows instance.
Fail to ping the public/private IP of the CVMs in this security group.
Fail to access over HTTP the web services exposed by the CVM instance in this security group.
The CVM instance under this security group may fail to access internet services.
Solutions
If any of the aforementioned problems occur, you can go to "Security Group" in the console and modify the security group rule. For example, you can change the rule to "bind only all-ports-open security groups by default".
For details of setting security group rules, see Security Group - Security Group Rules.
What do security group direction and policy mean?
The security group policy works in the directions of outbound and inbound. The former is to filter the outbound traffic of the CVM, and the latter is to filter the inbound traffic of the CVM.
Security group policies include Allow and Reject.
What is the order in which security group policies to go into effect?
The order that security group policies go into effect is from top to bottom. When traffic passes through the security group, policy matching is performed from top to bottom. A policy takes effect once matching is successful.
Why I opened a port in the security group, but the CVM is still not accessible?
Check whether the CVM is bound with another higher-priority security group, which reject this port.
The port is blocked by the network ACL or firewall.
The service corresponding to the port is not started.
The port is not open in the system firewall.
How come an IP that is not allowed in the security group can still access the CVM?
There are a few possible reasons for this:
The CVM is bound to multiple security groups, and the IP is allowed by another security group.
This IP address belongs to an approved Tencent Cloud public service.
Can iptables be used along with security groups?
Yes, security groups and iptables can be used simultaneously. Your traffic will be filtered twice in the following directions:
Outbound: processes in your instance > iptables > security groups.
Inbound: security groups > iptables > processes in your instance.
Why can’t the security groups be deleted even though all the CVMs have been returned?
Besides CVMs, a security group can also be bound with CLB, ENI and TencentDB instances. Please make sure that all resources bound with the security group have been disassociated.
When I clone a security group to another region, can the source and destination security group share the same name?
Yes.
Can I clone a security group to another project or region using an API?
When I clone a security group to another project or region, will the CVMs associated with the security groups also be cloned?
No, cloning a security group across different regions will only clone the entry and exit rules of the original security group. The CVM needs to be associated separately.
How do you ensure the security of CVMs in VPCs?
The VPC itself is a logically isolated network environment, and traffic can be controlled by configuring security groups and network ACL.
Security group: It provides network traffic control at the CVM instance level. Traffic that is not allowed to be in or out of the instance is automatically rejected.
Network ACL: It provides network traffic control at the subnet level.