Elastic Compute Service:Check security group rules

Procedure

1. Go to the ECS Console - Diagnostics page. Select the resource group and region of the target resource. Log on to the Alibaba Cloud console and confirm that the correct project and account are selected in the top navigation bar.

2. On the Self-service Troubleshooting page, on the Security Group Rule Diagnosis tab, click Initiate Diagnosis.

3. Select the target Instance and NIC.

4. Select a Check Mode and run the check.

   • Quick Check: Checks inbound rules for common ECS ports.

     Click Check. The following ports and protocols are checked:

     • 22: SSH remote connection to Linux instances.

     • 3389: RDP remote connection to Windows instances.

     • 80, 443, 8080: Web services.

     • ICMP: The ping command for network reachability testing.

   • Custom Check: Checks one-way access from a specific IP address to the ECS NIC.

     The following example checks an inbound rule from the Internet:

     • Rule Direction: Select Inbound Internet Direction.

     • Source IP Address: The source public IP address.

     • Destination Port: The port number to check.

     • Protocol Type: The protocol to check.

     Click Start Detection.

• View the check results.

  • Opened: The security group rule allows the specified traffic. If the service is still unavailable, check other factors, such as the internal firewall and service listener status.

  • Not Opened: The security group rule blocks the specified traffic. Click Enable Port to add an allow rule.

    Important

    Rules added by Open Port may set the source address to 0.0.0.0/0, which allows access from any IP address. For remote management ports such as 22 and 3389, modify security group rules to restrict the source to a specific IP address or CIDR block to prevent brute-force attacks and unauthorized access.

  • Cannot Open: The security group rule does not allow the specified traffic. Click Details to view details and manually adjust the rules.