Simple Application Server firewall settings - Simple Application Server

Simple Application Server uses firewalls instead of ECS security groups to control network access. A firewall controls inbound traffic to your Simple Application Server instances through firewall rules. You can add, modify, disable, enable, and delete firewall rules to secure your instances.

How it works

By default, the firewall for each Simple Application Server instance allows traffic on specific ports based on the operating system. All other ports are disabled. You can add firewall rules to allow traffic on additional ports as needed.

TCP protocol:
- Windows: Ports 3389, 80, and 443 are allowed by default for the TCP protocol.
- Linux: Ports 22, 80, and 443 are allowed by default for the TCP protocol.
ICMP protocol: All ports are allowed by default (port range set to -1), permitting access from any source IP address.

If you delete or disable these default rules in the console, a message such as You disabled or deleted the default allow rule for port 22, which affects the remote connection feature appears on the firewall page. You can add or enable the corresponding rules as needed.

Limitations

You can create a maximum of 50 firewall rules for a single Simple Application Server instance.
Port 25 is the default email service port. For security reasons, port 25 is restricted by default on Simple Application Server instances. If you need to send emails, use port 465.
The firewall can control only the inbound traffic of a Simple Application Server instance. All outbound traffic is allowed by default.
Note
- Inbound traffic: Data transmitted to an instance from the public network or an internal network.
- Outbound traffic: Data transmitted from an instance to the public network or an internal network.

Firewall settings

Note

If you have a firewall template, you can use it to quickly configure firewall rules. For more information, see Set firewall rules by using a firewall template.

Go to the Servers page in the Simple Application Server console.
Find the target Simple Application Server instance and click its ID on the instance card.
Click the Firewall tab.
In the upper-left corner of the Firewall page, click Add Rules.

In the Add Firewall Rule dialog box, configure the parameters and click Confirm.

Warning

When adding a firewall rule, configure the port range and allowed source IP addresses based on the principle of least privilege to prevent network attacks.
If you add a firewall rule with the same port, protocol, and source IP address as an existing rule, the new rule overwrites the existing one, regardless of whether the existing rule is enabled or disabled.

Preset rules

Select a preset rule to add it quickly.

Parameter	Description
Application type	Select an application type based on your needs, such as RDP, FTP, TELNET, MYSQL, All TCP, All UDP, or All TCP+UDP. For more information, see Preset ports.
Protocol	Displays the default protocol, which cannot be changed.
Port range	Displays the default port, which cannot be changed.
Source IP address	The default value is 0.0.0.0/0, which allows access from all IPv4 addresses. Important Configure this parameter based on the principle of least privilege to prevent network attacks.
Description	Enter a description to help you identify and manage the rule.

Custom rules

If preset rules do not meet your needs, you can create custom firewall rules.

Parameter	Description
Application type	Custom is selected by default.
Protocol	Select TCP, UDP, or ICMP.
Port range	The valid port range is 1 to 65535. The following formats are supported: Single port Enter a single port number. For example, to allow traffic on the MySQL database listening port, set the port range to `3306`. Port range Specify a range of ports separated by a forward slash (/). For example, to allow traffic on a custom port range of 20000 to 30000 for an FTP configuration, set the port range to `20000/30000`. The start port of a port range must be smaller than the end port. For example, `20000/30000` is valid, while `3000/3000` (start port equal to end port) is invalid and the system reports that the port range is invalid. To allow a single port, use the single-port format, for example, `3000`.
Source IP address	The default value is 0.0.0.0/0, which allows access from all IPv4 addresses. You can also specify custom allowed IPv4 addresses: Single IPv4 address Enter a single IPv4 address. For example: 192.168.0.100. Allow access from all IPv4 addresses in a CIDR block Enter an IPv4 CIDR block, for example: 192.168.0.0/24.
Description	Enter a description for the firewall rule to help identify and manage it.

You can click Add Rule or the icon to add or delete firewall rules as needed.

Manage firewall rules

After you add a firewall rule, you can modify, disable, enable, or delete it.

Actions	Description	Procedure
Modify a firewall rule	Modify any rule that no longer meets your requirements.	In the Actions column of the target firewall rule, click Edit. In the Edit dialog box, modify the protocol, port range, source IP address, and description as needed. Click OK.
Disable a firewall rule	To temporarily close a port, disable its rule instead of deleting it. Important Disabling a firewall rule may cause the corresponding port to become inaccessible, which can affect your services. Use this feature with caution and only after confirming it will not impact your business operations.	In the Actions column of the target firewall rule, click Disable. In the Disable dialog box, click OK.
Enable a firewall rule	Re-enable a previously disabled firewall rule when needed.	In the Actions column of the target firewall rule, click Enable. In the Enable dialog box, click OK.
Delete a firewall rule	Delete a firewall rule that is no longer needed. Note Instead of deleting a rule, consider disabling it, especially if you have not reached the 50-rule limit. This makes re-enabling the rule easier.	Single rule In the Actions column of the target firewall rule, click Delete. In the Delete dialog box, click OK. Bulk delete Select one or more firewall rules, and then click Delete at the bottom of the list. In the Delete dialog box, click OK.

Preset ports

Simple Application Server provides preset rules for common applications. The following table lists the details. For more information about common ports, see Common ports.

Application type	Protocol	Port range	Source IP	Description
HTTP	TCP	80	0.0.0.0/0 Important The default value is 0.0.0.0/0, which allows access from all IPv4 addresses. Configure this parameter based on the principle of least privilege to prevent network attacks.	The default port for the HTTP protocol, used for web services such as IIS, Apache, and Nginx. For more information, see Quickly create a Linux instance by using a system image.
HTTPS	TCP	443		The default port for the HTTPS protocol. For more information, see Install an SSL certificate in a Node.js environment (Linux).
RDP	TCP	3389		The default port for Remote Desktop Protocol (RDP), used to connect to Windows instances. For more information, see Connect to a Windows instance.
FTP	TCP	21		The default port for the FTP protocol, used for uploading and downloading files. For more information, see Build an FTP server on a Linux instance.
SSH	TCP	22		The SSH port, used to connect to Linux instances from the command line or with remote connection software such as PuTTY, Xshell, and SecureCRT. For more information, see Connect to a Linux instance.
TELNET	TCP	23		The default Telnet port.
MySQL	TCP	3306		The default port for MySQL databases. For more information, see Use DMS to connect to a database on an instance.
SQLServer	TCP	1433		The default SQL Server port.
All Use TCP	TCP	1-65535		All TCP ports.
All Use UDP	UDP	1-65535		All UDP ports.
All Use TCP and UDP	TCP+UDP	1-65535		All TCP and UDP ports.
Specify a custom value	TCP, UDP, or ICMP	1-65535		A custom port range.

FAQ

Q1: What is the difference between the Simple Application Server firewall and the operating system firewall?

Simple Application Server firewall: Offers a user-friendly interface in the console to control inbound traffic.
Operating system firewall: System administrators can set rules within the OS to control both inbound and outbound traffic. This requires familiarity with firewall software (such as iptables) and, for Linux, the command line.

Q2: Does Simple Application Server support security groups?

Simple Application Server does not use ECS security groups. To allow traffic on a port, use the firewall feature. To open multiple ports at the same time, add multiple rules or specify a port range (for example, 9797/9800).

Q3: How do I check if a port is accessible by using Telnet?

Run the following command to check if a port is open:

telnet <IP address> <port>

This example uses port 80. Example responses are shown below:

Windows

Port is open

C:\Users\Administrator>telnet 120.55.XX.XX 80
Connecting To 120.55.XX.XX...Connection succeeded.

Port is closed

C:\Users\Administrator>telnet 120.55.XX.XX 80
Connecting To 120.55.XX.XX...Could not open connection to the host, on port 80: Connect failed

Linux

Port is open

[root@VM-4-10-centos ~]# telnet 120.55.XX.XX 80
Trying 120.55.XX.XX...
Connected to 120.55.XX.XX.
Escape character is '^]'.

Port is closed

[root@VM-4-10-centos ~]# telnet 120.55.XX.XX 80
Trying 120.55.XX.XX...
telnet: connect to address 120.55.XX.XX: Connection refused

Q4: How do I check service and port listening status?

The following example shows how to troubleshoot a failure to access the Nginx service (default port 80) on a Simple Application Server instance. To troubleshoot other services, replace the service name and port number accordingly.

Linux

This procedure uses CentOS 7.9 as an example. The steps may vary for other Linux distributions.

Establish a remote connection to the Linux instance.

For more information, see Connect to a Linux instance.

Run the following command to check the Nginx service status:

systemctl status nginx

If a response similar to the following is returned, Nginx is running.

[xxx:@iZbp10zl6xzi         xxx: ~]# systemctl status nginx
● nginx.service - The nginx HTTP and reverse proxy server
   Loaded: loaded (/usr/lib/systemd/system/nginx.service; disabled; vendor preset: disabled)
   Active: active (running) since Sun 2023-06-04 17:04:32 CST; 3s ago
  Process: 12689 ExecStart=/usr/sbin/nginx (code=exited, status=0/SUCCESS)
  Process: 12686 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/SUCCESS)
  Process: 12684 ExecStartPre=/usr/bin/rm -f /run/nginx.pid (code=exited, status=0/SUCCESS)
 Main PID: 12692 (nginx)
   CGroup: /system.slice/nginx.service
           ├─12692 nginx: master process /usr/sbin/nginx
           ├─12693 nginx: worker process
           └─12694 nginx: worker process

If it is not running, run the following command to start the Nginx service:
```
systemctl start nginx
```

Run the following command to check if the port is listening:

netstat -an | grep 80

If the following response is returned, port 80 is listening correctly.

[xxx :@iZbp10zl6xzi30xxx ~]# netstat -an | grep 80
tcp        0      0 0.0.0.0:80              0.0.0.0:*                         LISTEN
tcp        0      0 172.xxx.xxx.xxx:52564   100.100.xxx.xxx:80                TIME_WAIT
tcp        0      0 172.xxx.xxx.xxx:52566   100.100.xxx.xxx:80                TIME_WAIT
tcp        0      0 172.xxx.xxx.xxx:51420   100.100.xxx.xxx:80                ESTABLISHED
tcp        0      0 172.xxx.xxx.xxx:52570   100.100.xxx.xxx:80                TIME_WAIT
tcp6       0      0 :::80                   :::*                              LISTEN

If the response is different, port 80 is not in a listening state.

Windows

This procedure uses Windows Server 2012 as an example. The steps are similar for other versions of Windows Server.

Establish a remote connection to the Windows instance.

For more information, see Connect to a Windows instance.
Choose Start> Run, enterservices.msc, and click OK to open the Services window.
Check the Nginx status.
1. If the nginx service has no status, right-click the nginx service and select Start.
2. If the status of the nginx service is Running, Nginx has started.

In Windows PowerShell, run the following command to check if the port is listening:

netstat -ano | findstr "80"

If the following response is returned, port 80 is listening correctly.

PS C:\Users\Administrator> netstat -ano | findstr "80"
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4148
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       6980
  TCP    17xxx:xxx              10xxx:xxx              ESTABLISHED     2004
  TCP    17xxx:697              12xxx:80               TIME_WAIT       0
  TCP    17xxx:832              18xxx:80               TIME_WAIT       0
  TCP    17xxx:901              18xxx:80               TIME_WAIT       0
  TCP    17xxx:970              18xxx:3xxx             ESTABLISHED     5732
  TCP    17xxx:973              18xxx:80               TIME_WAIT       0
  TCP    17xxx:999              12xxx:0                ESTABLISHED     984
  TCP    17xxx:000              18xxx:xxx              ESTABLISHED     984

If the response is different, port 80 is not in a listening state.

Q5: What should I do if a port on my Simple Application Server instance is inaccessible?

Cross-border access (including to and from the Hong Kong (China) region) can lead to network congestion, instability, or high latency. These issues stem from international link congestion and ISP routing, which are complex public network problems that can be slow to resolve.

Solutions:

If your business primarily serves the Chinese mainland, we recommend migrating your instance to a region in the Chinese mainland and then releasing the original instance. For more information, see Data migration between Simple Application Server instances.
Simple Application Server does not support changing the IP address to change the network link. If you are using an instance in the Hong Kong (China) region, you can try using an ECS instance with a BGP (Multi-ISP) Pro EIP. These EIPs provide a more direct network path to the Chinese mainland and can improve the network experience when bound to an ECS instance. However, this may not completely resolve all cross-border issues. For more information, see Migrate data from a Simple Application Server instance to an ECS instance by using a shared image, Request an EIP, and Associate an EIP with a cloud resource.

For other scenarios where a port is inaccessible, investigate the following possible causes:

Run the netstat -nltp | grep <port number> command to check whether a service is listening on the target port. If no service is listening on the port, start the corresponding service first.
Check for restrictions from the instance's internal firewall:
- Ubuntu: Use the sudo ufw status command.
- CentOS 7 and later: Use the firewall-cmd --list-ports command to view the allowed ports. To allow a new port, run firewall-cmd --zone=public --add-port=<port number>/tcp --permanent && firewall-cmd --reload. If firewalld is not running, run iptables -I INPUT -p tcp --dport <port number> -j ACCEPT to add an allow rule, and use iptables -L and iptables -t nat -L to view the rules.
In the Simple Application Server console, check whether a firewall rule has been added to allow traffic on the port.

Q6: Do I need to restart my Simple Application Server instance after modifying firewall rules?

No. Firewall rules take effect immediately after they are added or modified. You do not need to restart the instance.

Simple Application Server:Manage firewalls

How it works

Limitations

Firewall settings

Preset rules

Custom rules

Manage firewall rules

Single rule

Bulk delete

Preset ports

FAQ

Windows

Linux

Linux

Windows

Related topics