安全组详解，新手必看教程|云服务器 ECS - 开发者论坛

只想要你陪

<div class="f14 mb10" id="read_tpc">
<div align="left"><font size="6"><font face="宋体 ">前言</font></font><font face="Arial, sans-serif "></font></div><div align="left"><font face="宋体 ">不论你是新手还是已经对此有些了解，推荐再看一遍，因为<span onclick="sendmsg('pw_ajax.php','action=relatetag&tagname=安全',this.id)" style="cursor:pointer;border-bottom: 1px solid #FA891B;" id="rlt_10">安全</span>组的设置选项就如图那些东西，但是我们可以通过规则做的事情就有很多了。</font><font face="Arial, sans-serif "></font></div><div align="left"><font face="宋体 ">安全组顾名思义是为了安全所做的一些<span onclick="sendmsg('pw_ajax.php','action=relatetag&tagname=配置',this.id)" style="cursor:pointer;border-bottom: 1px solid #FA891B;" id="rlt_5">配置</span>，类似我们的防火墙，可以对流量进行一些简单的控制，这里可以提前了解一个，我们的不少童鞋说我去</font><font face="宋体 ">主机结果不通，或者怎么样子，那我们就要知道</font><font face="Arial, sans-serif ">ping</font><font face="宋体 ">的意义，是为了测试网络可达，它用的是</font><font face="Arial, sans-serif ">ICMP</font><font face="宋体 ">协议，如果在安全组你没有添加或者把它拒绝，那你觉得会</font><font face="Arial, sans-serif ">ping</font><font face="宋体 ">通吗？</font><font face="Arial, sans-serif "></font></div><div align="left"><font face="宋体 "><span id="att_138252" class="f12"><span id="td_att138252" onmouSEOver="read.open('menu_att138252','td_att138252');" style="display:inline-block;"><img src="http://bbs.aliyun.com/attachment/Fid_207/207_1208491576513081_ef9e28d61bd04d6.png?24" border="0" style="max-width:995px;" onload="if(this.offsetWidth>'995')this.width='995';"></span><div id="menu_att138252" class="pw_menu" style="display:none;"><div style="border:1px solid #ffffff;background:#f3f9fb;padding:5px 10px;"><p><span class="mr10">图片:1.png</span></p></div></div></span><span id="att_138253" class="f12"><span id="td_att138253" onmouseover="read.open('menu_att138253','td_att138253');" style="display:inline-block;"><img src="http://bbs.aliyun.com/attachment/Fid_207/207_1208491576513081_dac548c4a41ba1d.png?28" border="0" style="max-width:995px;" onload="if(this.offsetWidth>'995')this.width='995';"></span><div id="menu_att138253" class="pw_menu" style="display:none;"><div style="border:1px solid #ffffff;background:#f3f9fb;padding:5px 10px;"><p><span class="mr10">图片:2.png</span></p></div></div></span><span style="display:none"> {9)        
HB: </span>&nbsp;<br /></font></div><span style="display:none"> ~9,Fc6w4`+ </span>&nbsp;<br />可以通过图中的规则了解，我们的常用<span onclick="sendmsg('pw_ajax.php','action=relatetag&tagname=服务',this.id)" style="cursor:pointer;border-bottom: 1px solid #FA891B;" id="rlt_3">服务</span>就是上面的这些，那我们开始认识一下这些到底是干啥用的吧。<span style="display:none"> loHMQKy@ </span>&nbsp;<br /> <span style="display:none"> ]        yWywa\ </span>&nbsp;<br /><font size="5">一、快速添加规则</font><span style="display:none"> snNB;hkj </span>&nbsp;<br /> <span style="display:none"> z5D*UOy5M </span>&nbsp;<br /><font size="4">1.规则方向</font><span style="display:none"> RE-y5.kE^ </span>&nbsp;<br /><span id="att_138254" class="f12"><span id="td_att138254" onmouseover="read.open('menu_att138254','td_att138254');" style="display:inline-block;"><img src="http://bbs.aliyun.com/attachment/Fid_207/207_1208491576513081_c0bdc46f9bf5373.png?3" border="0" style="max-width:995px;" onload="if(this.offsetWidth>'995')this.width='995';"></span><div id="menu_att138254" class="pw_menu" style="display:none;"><div style="border:1px solid #ffffff;background:#f3f9fb;padding:5px 10px;"><p><span class="mr10">图片:3.png</span></p></div></div></span><span style="display:none"> {qU;>;( </span>&nbsp;<br />分为入方向和出方向两种<span style="display:none"> *.VNyay </span>&nbsp;<br />入方向是<span onclick="sendmsg('pw_ajax.php','action=relatetag&tagname=数据',this.id)" style="cursor:pointer;border-bottom: 1px solid #FA891B;" id="rlt_6">数据</span>进来的方向，出方向是数据出去的方向<span style="display:none"> >wFn|7\)s> </span>&nbsp;<br /> <span style="display:none"> I"QU{]|J </span>&nbsp;<br /><font size="4">2.授权策略</font><span style="display:none"> U'~]^F%eyu </span>&nbsp;<br /><span id="att_138255" class="f12"><span id="td_att138255" onmouseover="read.open('menu_att138255','td_att138255');" style="display:inline-block;"><img src="http://bbs.aliyun.com/attachment/Fid_207/207_1208491576513081_2d97a52ad06e923.png?3" border="0" style="max-width:995px;" onload="if(this.offsetWidth>'995')this.width='995';"></span><div id="menu_att138255" class="pw_menu" style="display:none;"><div style="border:1px solid #ffffff;background:#f3f9fb;padding:5px 10px;"><p><span class="mr10">图片:4.png</span></p></div></div></span><span style="display:none"> 2z        AxGX </span>&nbsp;<br /> <span style="display:none"> b.8T&lt;@a </span>&nbsp;<br /> <span style="display:none"> wbk$(P'gN </span>&nbsp;<br />当我们选择好你数据是进来还是出去的时候，是不是就要知道这个数据是让允许还是拒绝出去尼，在这里就可以进行控制了。<span style="display:none"> &'        y}L' </span>&nbsp;<br /> <span style="display:none"> k!x`cp </span>&nbsp;<br /> <span style="display:none"> zz&lt;o4bR </span>&nbsp;<br /><font size="4">3. 常用端口</font><span style="display:none"> OB^j
b8 </span>&nbsp;<br /><span id="att_138256" class="f12"><span id="td_att138256" onmouseover="read.open('menu_att138256','td_att138256');" style="display:inline-block;"><img src="http://bbs.aliyun.com/attachment/Fid_207/207_1208491576513081_37485f7087271a9.png?7" border="0" style="max-width:995px;" onload="if(this.offsetWidth>'995')this.width='995';"></span><div id="menu_att138256" class="pw_menu" style="display:none;"><div style="border:1px solid #ffffff;background:#f3f9fb;padding:5px 10px;"><p><span class="mr10">图片:5.png</span></p></div></div></span><span style="display:none"> L$"pk{' </span>&nbsp;<br /> <span style="display:none"> SLH;iqPT </span>&nbsp;<br />如果说IP地址是我们的门牌号，那么端口就是你从哪个门进去了。<span style="display:none">         !t{ </span>&nbsp;<br />我们普遍使用的是上面那么“门”那就要了解这些门是干啥的了。<span style="display:none"> (h[.
Ie </span>&nbsp;<br />SSH的端口是22，通常是用于远程登录所用，注意你的<span onclick="sendmsg('pw_ajax.php','action=relatetag&tagname=服务器',this.id)" style="cursor:pointer;border-bottom: 1px solid #FA891B;" id="rlt_1">服务器</span>是Linux的<span onclick="sendmsg('pw_ajax.php','action=relatetag&tagname=系统',this.id)" style="cursor:pointer;border-bottom: 1px solid #FA891B;" id="rlt_7">系统</span>哦（除了Windows系统之外的那些），只有Linux的系统才能使用SSH登录。SSH默认都是安装好的，我们不需要什么额外的<span onclick="sendmsg('pw_ajax.php','action=relatetag&tagname=操作',this.id)" style="cursor:pointer;border-bottom: 1px solid #FA891B;" id="rlt_9">操作</span>，那么如何使用SSH进行登录尼？<span style="display:none"> 4af^SZ)l </span>&nbsp;<br />https://bbs.aliyun.com/read/571061.html<span style="display:none"> 2^Z"4t4 </span>&nbsp;<br /> <span style="display:none"> mtw{7E </span>&nbsp;<br />Telnet是提供的远程终端服务，一般Windows连接Windows，在命令行模式下进行登录，不过现在高版本的系统要<span onclick="sendmsg('pw_ajax.php','action=relatetag&tagname=自',this.id)" style="cursor:pointer;border-bottom: 1px solid #FA891B;" id="rlt_4">自</span>己去安装这个服务，默认你本地电脑是没有的。自己不太常用这个。<span style="display:none"> r
Cz,XYV </span>&nbsp;<br /> <span style="display:none"> +CXq41g"c </span>&nbsp;<br />HTTP服务超文本传输协议 端口80 也就是我们天天看的<span onclick="sendmsg('pw_ajax.php','action=relatetag&tagname=网站',this.id)" style="cursor:pointer;border-bottom: 1px solid #FA891B;" id="rlt_2">网站</span>访问时使用的协议，这个当然要允许了<span style="display:none"> H:WuMwD4 </span>&nbsp;<br /> <span style="display:none"> 9C!b
f \ </span>&nbsp;<br />HTTPS是http的加强版，如果你想网站不被运营商什么的挂上广告或者被监听可以配置一个https的，它需要SSL。<span style="display:none"> ;        3sjTqD </span>&nbsp;<br /> <span style="display:none"> n;:C{5 </span>&nbsp;<br />MS SQL数据库如果是这个就需要开启了<span style="display:none"> |0X~D}r|J </span>&nbsp;<br /> <span style="display:none"> T&:~= </span>&nbsp;<br />Oracle 同样是<span onclick="sendmsg('pw_ajax.php','action=relatetag&tagname=数据库',this.id)" style="cursor:pointer;border-bottom: 1px solid #FA891B;" id="rlt_8">数据库</span><span style="display:none"> 6uk}4
bdvq </span>&nbsp;<br /> <span style="display:none"> Sogt?]HB$ </span>&nbsp;<br />MYSQL 还是数据库<span style="display:none"> hx4c`fOs </span>&nbsp;<br /> <span style="display:none"> }KNBqPo4B </span>&nbsp;<br />RDP这个就是Windows远程连接桌面使用的协议了3389，有时候被人恶意扫描也是这个端口。<span style="display:none"> ,,Ivey!kL </span>&nbsp;<br /> <span style="display:none"> 41Ab, </span>&nbsp;<br />PostgreSQL这个只在kali上用过同样是数据库<span style="display:none"> tDMNpl </span>&nbsp;<br /> <span style="display:none"> Jc`tOp5 </span>&nbsp;<br /> <span style="display:none"> 9ESV[ </span>&nbsp;<br />Redis日志型的数据库<span style="display:none"> ''q#zEf6 </span>&nbsp;<br /> <span style="display:none"> /xBO;'rR </span>&nbsp;<br /> <span style="display:none"> gr#        |ZK.` </span>&nbsp;<br /><font size="4">4.自定义端口</font><span style="display:none"> ,#%I$ </span>&nbsp;<br /><span id="att_138257" class="f12"><span id="td_att138257" onmouseover="read.open('menu_att138257','td_att138257');" style="display:inline-block;"><img src="http://bbs.aliyun.com/attachment/Fid_207/207_1208491576513081_735410eb860399b.png?3" border="0" style="max-width:995px;" onload="if(this.offsetWidth>'995')this.width='995';"></span><div id="menu_att138257" class="pw_menu" style="display:none;"><div style="border:1px solid #ffffff;background:#f3f9fb;padding:5px 10px;"><p><span class="mr10">图片:6.png</span></p></div></div></span><span style="display:none"> a(G}&lt; </span>&nbsp;<br /> <span style="display:none"> r$x;
rL4 </span>&nbsp;<br />TCP  UDP协议<span style="display:none"> r8[)Ccv </span>&nbsp;<br />TCP传输控制协议 可靠的连接 速度不如UDP快<span style="display:none"> O]j&lt;$GG! </span>&nbsp;<br />UDP 用户数据报协议 不可靠的无连接传输协议，速度快，通常音频类等需要快速传输的是这个协议<span style="display:none"> g8"H{u </span>&nbsp;<br /><span style="background-color:white "><span style="color:#454545 ">21----- </font></span></span><span style="background-color:white "><span style="color:#454545 ">（tcp ）FTP文件传输协议</font></span></span><span style="color:#454545 "><span style="background-color:white ">22------</span><span style="background-color:white ">（tcp）SSH安全登录、网络间传送（SCP）和端口重定向</span></font></span><span style="color:#454545 "><span style="background-color:white ">220/tcp IMAP3 </span><span style="background-color:white ">443/tcp HTTPS</span></font></span><span style="display:none"> C5e;U </span>&nbsp;<br /> <span style="display:none"> FC]n?1?&lt;( </span>&nbsp;<br /><span style="background-color:white "><span style="color:#454545 ">DNS UDP </font></span></span><span style="display:none"> o*oFCR]j </span>&nbsp;<br /><span style="background-color:white "><span style="color:#454545 "><span style="display:none"> .Sv/0&O </span>&nbsp;<br /></font></span></span><span style="display:none"> +Y$EZL.A </span>&nbsp;<br /><font size="4">5.授权类型</font><span style="display:none"> \BO6.;jA </span>&nbsp;<br /><span id="att_138258" class="f12"><span id="td_att138258" onmouseover="read.open('menu_att138258','td_att138258');" style="display:inline-block;"><img src="http://bbs.aliyun.com/attachment/Fid_207/207_1208491576513081_1d5df2bb09f1f71.png?4" border="0" style="max-width:995px;" onload="if(this.offsetWidth>'995')this.width='995';"></span><div id="menu_att138258" class="pw_menu" style="display:none;"><div style="border:1px solid #ffffff;background:#f3f9fb;padding:5px 10px;"><p><span class="mr10">图片:7.png</span></p></div></div></span><span style="display:none"> +/"        \.wYv </span>&nbsp;<br /> <span style="display:none"> vskp1Wi( </span>&nbsp;<br /><span style="background-color:white "><span style="color:#454545 "></font></span></span><span style="display:none"> D#^euNiWd </span>&nbsp;<br />如果是第一次选择地址段访问，来设置，当多个服务器需要设置的时候选择安全组访问可以添加之前设置好的安全组规则，比较省事。<span style="display:none"> p\.IP2+c </span>&nbsp;<br /> <span style="display:none"> vTIRydg2b </span>&nbsp;<br /> <span style="display:none"> .>LJ(Sx9b </span>&nbsp;<br /><font size="4">6.授权对象</font><span style="display:none"> k~fH:X~x </span>&nbsp;<br /><span id="att_138259" class="f12"><span id="td_att138259" onmouseover="read.open('menu_att138259','td_att138259');" style="display:inline-block;"><img src="http://bbs.aliyun.com/attachment/Fid_207/207_1208491576513081_4c1955c9a06a475.png?2" border="0" style="max-width:995px;" onload="if(this.offsetWidth>'995')this.width='995';"></span><div id="menu_att138259" class="pw_menu" style="display:none;"><div style="border:1px solid #ffffff;background:#f3f9fb;padding:5px 10px;"><p><span class="mr10">图片:8.png</span></p></div></div></span><span style="display:none"> 4Tb"+Y
} </span>&nbsp;<br /> <span style="display:none"> @Qp#Tg&lt;' </span>&nbsp;<br /> <span style="display:none"> %J1oz3n </span>&nbsp;<br />也就是你允许哪个网段的人来连接，比如想你自己的1.1.1.1的IP地址访问某服务，可以衰弱1.1.1.1/32.<span style="display:none"> Py?Q:: </span>&nbsp;<br /> <span style="display:none"> _>8Q{N\-
{ </span>&nbsp;<br /> <span style="display:none"> vUDMl Z </span>&nbsp;<br /><span id="att_138260" class="f12"><span id="td_att138260" onmouseover="read.open('menu_att138260','td_att138260');" style="display:inline-block;"><img src="http://bbs.aliyun.com/attachment/Fid_207/207_1208491576513081_b3520142fa60e59.png?35" border="0" style="max-width:995px;" onload="if(this.offsetWidth>'995')this.width='995';"></span><div id="menu_att138260" class="pw_menu" style="display:none;"><div style="border:1px solid #ffffff;background:#f3f9fb;padding:5px 10px;"><p><span class="mr10">图片:9.png</span></p></div></div></span><span style="display:none"> H5o=nWQ6e </span>&nbsp;<br /><div align="left"><font face="宋体 ">私有地址范围 </font></div><div align="left"><font face="宋体 ">10.0.0.0~10.255.255.255 </font></div><div align="left"><font face="宋体 ">172.16.0.0~172.31.255.255</font></div><div align="left"><font face="宋体 ">192.168.0.0~192.168.255.255</font></div><div align="left"><font face="宋体 ">特殊地址 </font></div><div align="left"><font face="宋体 ">127.0.0.0 ~127.255.255.255  </font><font face="宋体 ">本地环回网段   测试本地连通性 </font></div><div align="left"><font face="宋体 ">0.0.0.0           </font><font face="宋体 ">所有网络   缺省路由</font></div><div align="left"><font face="宋体 ">255.255.255.255  </font><font face="宋体 ">有限广播地址    只能在本网段广播 </font></div><span style="display:none"> 6
&
6|R3 </span>&nbsp;<br /> <div align="left"><font face="Tahoma, sans-serif ">192.168.1.0/24</font><font face="宋体 ">的网段</font></div><div align="left"><font face="Tahoma, sans-serif ">A:100</font><font face="宋体 ">台</font><font face="宋体 ">  我们要划分一百台IP地址给我们其他的服务器</font></div><div align="left"><span style="display:none"> Yb1Q6[! </span>&nbsp;<br /></div><div align="left"><font face="Tahoma, sans-serif ">2ⁿ-2&gt;100</font><font face="宋体 ">公式</font></div><div align="left"><font face="Tahoma, sans-serif ">n=7</font><font face="宋体 ">主机位是7</font></div><div align="left"><font face="宋体 ">主机位：</font><font face="Tahoma, sans-serif ">7</font><font face="宋体 "></font></div><div align="left"><font face="宋体 ">网络位：</font><font face="Tahoma, sans-serif ">25</font><font face="宋体 ">  32-7=25</font></div><div align="left"><span style="display:none"> 'rA(+-.M; </span>&nbsp;<br /></div><div align="left"><font face="宋体 ">大家可以联系试试</font></div><div align="left">10.0.0.0/8</font><font face="宋体 ">的网段划分2W个ip</font></div><div align="left"><span style="display:none"> Sl@Ucc31 </span>&nbsp;<br /></font></div><div align="left"><font face="宋体 ">答案</font></div><div align="left">32-15=17</font><font face="宋体 ">网络位</font></div><div align="left">10.0.0.0/17</font><font face="宋体 ">网段</font></div><div align="left">10.0.0.0</font><font face="宋体 ">网络地址</font></div><div align="left">10.0.127.255</font><font face="宋体 ">广播地址</font></div><div align="left">10.0.0.1-10.0.127.254</font><font face="宋体 ">可使用范围</font></font></div><span style="display:none"> Jb-.x_Bf </span>&nbsp;<br /> <span style="display:none"> C;.,+(G </span>&nbsp;<br /> <span style="display:none"> Z9Z\2t </span>&nbsp;<br />如果想让任意范围的都可以访问尼，0.0.0.0/0<span style="display:none"> nlaW$b{= </span>&nbsp;<br /> <span style="display:none">  0Q)YZ2 </span>&nbsp;<br /> <span style="display:none"> M+:9U&>
</span>&nbsp;<br /><font size="4">7.规则优先级</font><span style="display:none"> {-%8RSK=&lt; </span>&nbsp;<br /><span id="att_138261" class="f12"><span id="td_att138261" onmouseover="read.open('menu_att138261','td_att138261');" style="display:inline-block;"><img src="http://bbs.aliyun.com/attachment/Fid_207/207_1208491576513081_ac9cd16454c81ab.png?1" border="0" style="max-width:995px;" onload="if(this.offsetWidth>'995')this.width='995';"></span><div id="menu_att138261" class="pw_menu" style="display:none;"><div style="border:1px solid #ffffff;background:#f3f9fb;padding:5px 10px;"><p><span class="mr10">图片:10.png</span></p></div></div></span><span style="display:none"> RaP,dR+P </span>&nbsp;<br /> <span style="display:none"> *kEzGgTzoS </span>&nbsp;<br /> <span style="display:none"> y*p02\)         </span>&nbsp;<br />数字越小越优先匹配<span style="display:none"> FW|_8q?}&lt; </span>&nbsp;<br /> <span style="display:none"> E]=>@EX </span>&nbsp;<br /> <span style="display:none"> V)vik </span>&nbsp;<br /><font size="4">8.描述</font><span style="display:none"> l,zhBnD </span>&nbsp;<br /><span id="att_138262" class="f12"><span id="td_att138262" onmouseover="read.open('menu_att138262','td_att138262');" style="display:inline-block;"><img src="http://bbs.aliyun.com/attachment/Fid_207/207_1208491576513081_3807c169b6a3de6.png?4" border="0" style="max-width:995px;" onload="if(this.offsetWidth>'995')this.width='995';"></span><div id="menu_att138262" class="pw_menu" style="display:none;"><div style="border:1px solid #ffffff;background:#f3f9fb;padding:5px 10px;"><p><span class="mr10">图片:11.png</span></p></div></div></span><span style="display:none"> T''&lt;yS         </span>&nbsp;<br /> <span style="display:none"> ;~'&m </span>&nbsp;<br />这里可以备注规则匹配的什么。<span style="display:none"> ZDov2W </span>&nbsp;<br /> <span style="display:none"> U.JE        \/ </span>&nbsp;<br /> <span style="display:none"> "fW
}6pS </span>&nbsp;<br /><font size="5">一、添加安全组规则</font><span style="display:none"> TQ5kM </span>&nbsp;<br /><span id="att_138263" class="f12"><span id="td_att138263" onmouseover="read.open('menu_att138263','td_att138263');" style="display:inline-block;"><img src="http://bbs.aliyun.com/attachment/Fid_207/207_1208491576513081_94ce2ce3479793c.png?27" border="0" style="max-width:995px;" onload="if(this.offsetWidth>'995')this.width='995';"></span><div id="menu_att138263" class="pw_menu" style="display:none;"><div style="border:1px solid #ffffff;background:#f3f9fb;padding:5px 10px;"><p><span class="mr10">图片:12.png</span></p></div></div></span><span style="display:none">         \PcnD$L </span>&nbsp;<br /> <span style="display:none">         +_+j"BT </span>&nbsp;<br /> <span style="display:none"> mrr~#Bb> </span>&nbsp;<br />我们的ICMP如果不允许是不能ping通的，这也解释了为什么有的网站不能ping因为把这个icmp协议给顾虑了。另外里面的GRE是隧道，在VPN中会用到。<span style="display:none"> 4u"Bll </span>&nbsp;<br /> <span style="display:none"> 
beSU[ </span>&nbsp;<br /> <span style="display:none"> ga(k2Q;y </span>&nbsp;<br /><font size="4">三、导入导出规则</font><span style="display:none"> ;47z.i&T </span>&nbsp;<br /><span id="att_138264" class="f12"><span id="td_att138264" onmouseover="read.open('menu_att138264','td_att138264');" style="display:inline-block;"><img src="http://bbs.aliyun.com/attachment/Fid_207/207_1208491576513081_87f0ffb313784fc.png?2" border="0" style="max-width:995px;" onload="if(this.offsetWidth>'995')this.width='995';"></span><div id="menu_att138264" class="pw_menu" style="display:none;"><div style="border:1px solid #ffffff;background:#f3f9fb;padding:5px 10px;"><p><span class="mr10">图片:13.png</span></p></div></div></span><span style="display:none"> !&NrbiuN </span>&nbsp;<br /> <span style="display:none"> /?($W|9+l </span>&nbsp;<br /><font face="等线 ">通过我们的导入导出规则可以很方便的将你的配置给其他人或者导出进行备份都是很不错的选择</font><span style="display:none"> {8oGWQgrj </span>&nbsp;<br /><font face="等线 "><span style="display:none"> Ez-Q'v(9 </span>&nbsp;<br /></font><span style="display:none"> vm'ZA7f6 </span>&nbsp;<br /> <span style="display:none"> N/--6)5~0 </span>&nbsp;<br /><div id="alert_tpc" style="color:gray;margin-top:30px">[ 此帖被我的中国在2017-11-30 15:31重新编辑 ]</div>
</div>
</div>
<!--content_read-->
</td>
</tr>
<tr>