Network security
Simple Application Server secures network access through VPC isolation and built-in firewalls.
Use a VPC for private network isolation
Each Simple Application Server instance runs in an Alibaba Cloud VPC. Instances under the same account and region share a VPC and can communicate over the private network. However, they cannot communicate over the private network with other Alibaba Cloud services such as ECS instances and ApsaraDB databases.
Enable service interconnection to allow private network communication between Simple Application Server instances and other Alibaba Cloud services in the same VPC. Manage service interconnection.
Use a firewall to block attack traffic
Simple Application Server includes a built-in firewall that uses intrusion detection to inspect and filter traffic. By default, only ports 22, 80, and 443 are open, and all other ports are closed. Open additional ports as needed in Manage the firewall.
The firewall controls only the inbound traffic of a Simple Application Server instance. All outbound traffic is allowed by default.
-
Inbound traffic: traffic flowing to an instance from the public network or a private network.
-
Outbound traffic: traffic flowing from an instance to a destination over the public network or internal network.
Attack prevention
Prevent DDoS attacks
Simple Application Server instances exposed to the public network may face DDoS attacks. The system automatically applies traffic scrubbing when an attack is detected. If scrubbing is insufficient or attack traffic reaches the blackhole threshold, blackhole routing is triggered.
DDoS protection is enabled by default and requires no configuration.
Blackhole routing deactivates automatically after 2.5 hours.
Access Simple Application Server instances over the private network to protect them from DDoS attacks.
Prevent network intrusions
Simple Application Server uses Security Center for threat detection and intrusion prevention. Activate Security Center to enable this feature. Basic security services.