Hello, Pupu!
Both virtual firewalls and security groups are used to ensure the security of cloud servers in a VPC.
You can set up a virtual firewall to add a security layer to your VPC based on security groups for flexible and layered security management of your VPC.
Differences between virtual firewalls and security groups
Item | Security Group | Virtual Firewall |
---|
Protection object | Cloud servers | Subnets in Region Type I |
Configuration policy | Only the Allow policy is supported. | Allow, Reject, and Deny policies are supported. NOTE: Reject applies only to the Region Type II scenario. |
Priority | If multiple security group rules conflict, the union set takes effect. | If multiple firewall rules conflict, the rules earlier in sequence take precedence. |
Default rule | All data packets in the outbound direction are allowed to pass through. Only the traffic in the security group is allowed to pass in the inbound direction. | Allows broadcast packets with a destination of 255.255.255.255/32 in Region Type I. Allows multicast packets with a destination of 224.0.0.0/24 in Region Type I. Allows metadata packets with a destination of 169.254.169.254/32 and with TCP port 80 in Region Type I. Allows packets from the CIDR blocks that are reserved for public services. For example, allows packets with a destination of 100.126.0.0/16 in Region Type I. Allows packets with a destination of ff00::/8 (multicast IP address) in Region Type I. Allows packets with a source of fe80::/64 (link local IP address) and destination of fe80::/64 (link local IP address) in Region Type I. Denies all other packets by default in Region Type I.
|
Application operations | By default, a security group must be selected during cloud server creation. The security group is automatically applied to the cloud server. | You must create a virtual firewall, associate a subnet in Region Type I with the virtual firewall, and add firewall rules so that the virtual firewall can apply to the corresponding cloud server. |
Packet filtering | Only supports packet filtering based on the 3-tuple (protocol, port, and peer IP address). | Supports packet filtering based on the 5-tuple (protocol, source port, destination port, source IP address, and destination IP address). |
Have a nice day!