All Products
Search

This Product

    Bastionhost:Enable private O&M portal

    Document Center

    Bastionhost:Enable private O&M portal

    Last Updated:Sep 19, 2026

    For enhanced security, Bastionhost supports web-based O&M over a private network. This topic describes how to enable the private O&M portal to access your Bastionhost instance from a private network.

    Background

    Bastionhost uses PrivateLink to create a secure private connection between your VPC and the Bastionhost service. This lets you access the O&M portal and perform web-based O&M over a private network, which significantly enhances security.

    Editions

    Only the Enterprise Edition and SM-compliant Edition of Bastionhost support the private O&M portal. To purchase or upgrade an instance, see Purchase an instance and Upgrade instance specifications.

    Impacts

    Enabling the private O&M portal affects your Bastionhost instance in the following ways:

    • The resolved IP address of the private O&M portal changes. You must use the O&M domain name provided in the console for all operations.

    • If you have access control policies, such as firewall rules, based on the previous private IP address, you must update them with the new one.

    Warning

    After you enable the private O&M portal, you may experience login failures when you use the Xshell client to connect to Bastionhost due to compatibility issues.

    Procedure

    1. Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.

    2. On the Instances page, for the target instance, go to Configuration > Enable Private O&M.

    3. In the Enable Private O&M panel, select a PrivateLink endpoint security group, and then click OK.

      Important

      • If you have access control policies (such as firewall rules) based on the private egress IP address, you must update them with the new one.

      • During the update, the instance is inaccessible and its status changes to Updating Configuration. The process takes about 20 minutes. Perform this operation during off-peak hours to minimize disruption.

      • The selected PrivateLink endpoint security group cannot be changed once configured.

    Next steps

    Configure client access rules

    For private web-based O&M, your client must connect to the VPC of the Bastionhost instance. You must also add rules to the PrivateLink endpoint security group to allow client traffic; otherwise, the client cannot access the private O&M address. The following list shows the common Bastionhost services and ports. Configure access rules based on your requirements.

    • SSH O&M: 60022

    • RDP O&M: 63389

    • Session playback port: 9443

    • Host O&M and O&M portal port: 443

    • Bastionhost Assistant port: 20045

    For example, to configure a security group rule for SSH-based O&M from a client with the IP address 192.168.0.1, see Add a security group rule.

    In the inbound rules of the security group, add a rule with the following settings: set Action to Allow, priority to 1, protocol type to Custom TCP, Source to 192.168.0.1, and port range to 60022/60022.

    When you enable the private O&M portal, the PrivateLink endpoint security group can only be selected from the VPC in which the Bastionhost instance resides. You cannot directly associate or reuse security groups from other regions.

    To access the Bastionhost private O&M portal from a client in a different region, perform the following steps:

    1. Use Cloud Enterprise Network (CEN) to connect the VPCs across regions.

    2. After the VPCs are connected, manually add inbound rules in the security groups of each region to allow the Bastionhost private egress IP address.

    Troubleshoot access failures

    If you have configured the client access rules but still cannot access the private O&M portal, check the following scenarios:

    Scenario 1: Session playback fails and you cannot ping the O&M domain name

    1. Confirm that Private O&M is enabled for the instance. For more information, see the Procedure section of this topic.

    2. Check whether the PrivateLink endpoint security group allows inbound access on the following ports:

      • Session playback port: 9443

      • Host O&M and O&M portal port: 443

    Scenario 2: Cross-account or cross-VPC connection to an ECS instance fails (for example, you cannot ping the internal IP address of the peer ECS instance)

    In addition to checking whether the security group allows the Bastionhost-related ports (such as 60022), also check the following:

    1. Route conflicts: Check whether the client or the destination ECS instance has a route that conflicts with the VPC CIDR block (for example, the default Docker CIDR block 172.17.0.0/16). To resolve this, change the Docker CIDR block or add a more specific route.

    2. Public IP addresses used within a private network: If the destination server's IP address falls within a range that is publicly routable but used privately (for example, 172.x.x.x), add the server's IP CIDR block to the Public IP addresses used within a private network configuration in the Bastionhost console.

    FAQ

    Why is there no whitelist configuration menu in the Bastionhost console?

    The whitelist configuration menu corresponds to the public access whitelist feature. This menu is displayed only after a public O&M address is enabled for the instance. If the instance does not have public network access enabled, the whitelist configuration menu is not displayed in the console. To make the menu appear, enable public network access for the instance.

    Related documents

    To learn how O&M engineers perform web-based O&M, see Web-based O&M.