Elastic Compute Service:Check security group rules

Procedure

1. Go to the ECS Console - Diagnostics page. Select the resource group and region of the target resource. Log on to the Alibaba Cloud console and confirm that the correct project and account are selected in the top navigation bar.

2. On the Self-service Troubleshooting page, on the Security Group Rule Diagnosis tab, click Initiate Diagnosis.

3. Select the target Instance and NIC.

4. Select a Check Mode and run the check.

   • Quick Check: Checks inbound rules for common ECS ports.

     Click Check. The following ports and protocols are checked:

     • 22: SSH remote connection to Linux instances.

     • 3389: RDP remote connection to Windows instances.

     • 80, 443, 8080: Web services.

     • ICMP: The ping command for network reachability testing.

   • Custom Check: Checks one-way access from a specific IP address to the ECS NIC.

     The following example checks an inbound rule from the Internet:

     • Rule Direction: Select Internet Ingress.

     • Source IP Address: The source public IP address.

     • Destination Port: The port number to check.

     • Protocol Type: The protocol to check.

     Click Check.

• View the check results.

  • Enabled: The security group rule allows the specified traffic. If the service is still unavailable, check other factors, such as the internal firewall and service listener status.

  • Failed to Enable: The security group rule blocks the specified traffic. Click Enable Port to add an allow rule.

    Important

    Rules added by Enable Port may set the source address to 0.0.0.0/0, which allows access from any IP address. For remote management ports such as 22 and 3389, modify security group rules to restrict the source to a specific IP address or CIDR block to prevent brute-force attacks and unauthorized access.

  • Disabled: The security group rule does not allow the specified traffic. Click Details to view details and manually adjust the rules.