All Products
Search

This Product

    Bastionhost:Enable private O&M portal

    Document Center

    Bastionhost:Enable private O&M portal

    Last Updated:Jun 21, 2026

    For enhanced security, Bastionhost supports web-based O&M over a private network. This topic describes how to enable the private O&M portal to access your Bastionhost instance from a private network.

    Background

    Bastionhost uses PrivateLink to create a secure private connection between your VPC and the Bastionhost service. This lets you access the O&M portal and perform web-based O&M over a private network, which significantly enhances security.

    Editions

    Only the Enterprise Edition and SM-compliant Edition of Bastionhost support the private O&M portal. To purchase or upgrade an instance, see Purchase an instance and Upgrade instance specifications.

    Impacts

    Enabling the private O&M portal affects your Bastionhost instance in the following ways:

    • The resolved IP address of the private O&M portal changes. You must use the O&M domain name provided in the console for all operations.

    • If you have access control policies, such as firewall rules, based on the previous private IP address, you must update them with the new one.

    Warning

    After you enable the private O&M portal, you may experience login failures when you use the Xshell client to connect to Bastionhost due to compatibility issues.

    Procedure

    1. Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.

    2. On the Instances page, for the target instance, go to Configuration > Enable Private O&M.

    3. In the Enable Private O&M panel, select a PrivateLink endpoint security group, and then click OK.

      Important

      • If you have access control policies (such as firewall rules) based on the private egress IP address, you must update them with the new one.

      • During the update, the instance is inaccessible and its status changes to Updating Configuration. The process takes about 20 minutes. Perform this operation during off-peak hours to minimize disruption.

      • The selected PrivateLink endpoint security group cannot be changed once configured.

    Next steps

    Configure client access rules

    For private web-based O&M, your client must connect to the VPC of the Bastionhost instance. You must also add rules to the PrivateLink endpoint security group to allow client traffic; otherwise, the client cannot access the private O&M address. The following list shows the common Bastionhost services and ports. Configure access rules based on your requirements.

    • SSH O&M: 60022

    • RDP O&M: 63389

    • Session playback port: 9443

    • Host O&M and O&M portal port: 443

    • Bastionhost Assistant port: 20045

    For example, to configure a security group rule for SSH-based O&M from a client with the IP address 192.168.0.1, see Add a security group rule.

    In the inbound rules of the security group, add a rule with the following settings: set Action to Allow, priority to 1, protocol type to Custom TCP, Source to 192.168.0.1, and port range to 60022/60022.

    Related documents

    To learn how O&M engineers perform web-based O&M, see Web-based O&M.