Docs

Elastic Compute Service

Network connection issue

Configuring firewall policies for ECS instances on Windows Server

This topic describes how to configure the firewall in Windows Server. In this example, Windows Server 2022 Datacenter is used.

This topic may contain information about third-party products, which is provided for reference only. The Volcano Engine platform makes no implication or other form of commitment regarding the performance and reliability of third-party products, or potential impacts that may result from their operation.

Allow an app or feature through Windows Defender Firewall

Use VNC to log in to the target instance.

Select "Start > Control Panel > System and Security > Windows Defender Firewall".

In the left directory tree, select "Allow an app or feature through Windows Defender Firewall".

Click the "Allow another app..." button.

On the page for adding apps, select the target app and click the "Add" button to complete the operation.

tip

If the app you want to allow is not listed in the app module, click the "Browse" button to locate and select the target application file in the file system.

Allow or block access to specific local ports

Use VNC to log in to the target instance.

Select "Start > Control Panel > System and Security > Windows Defender Firewall".

In the left directory tree, select "Advanced settings".

In the left directory tree, select "Inbound Rules" and click the "New Rule" button in the right "Actions" pane.

Select "Port" and click the "Next" button.

Configure the protocol type and port range for the current inbound rule based on your needs, and then click the "Next" button.

Specify the type of action to be taken when an inbound request matches the rules you configured, and click the "Next" button.

Parameter	Description
Allow the connection	Allow connections that match the conditions of this rule. In other words, permit access to the ports you configured. The firewall will not perform any authentication or security checks on the connections.
Allow the connection if it is secure	Allow only connections authenticated and encrypted via IPsec. You can customize the secure connection rules.
Block the connection	Reject and block connections that match the conditions of this rule. In other words, prohibit access to the ports you configured. Connection attempts will be discarded directly.

Select the scope for the current rule and click the "Next" button.

tip

By default, all scope options are selected. Select the scope based on the actual network environment.

After you enter the rule name, click the "Finish" button.

Allow or block access from specific IP addresses

Use VNC to log in to the target instance.

Select "Start > Control Panel > System and Security > Windows Defender Firewall".

In the left directory tree, select "Advanced settings".

In the left directory tree, select "Inbound Rules" and click the "New Rule" button in the right "Actions" pane.

Select "Custom", and click the "Next" button.

Select the applicable program scope for the current rule based on your needs, and click the "Next" button.

tip

"All programs" indicates all programs on the local machine.

"This program path:" indicates a specific program.

Configure the ports and protocols to which the rule applies based on your needs, and click the "Next" button.

Select the scope for the current rule.

Based on the target IP address type, select "These IP addresses" in the corresponding module (for example, select IP addresses in the "Which remote IP addresses does this rule apply to?" module when restricting external IP address access), and click the "Add" button.

Configure the target IP address or CIDR block in the pop-up window, and click the "OK" button.

To add multiple IP addresses or CIDR blocks to be restricted, click the "Add" button again to complete the configuration.

Click the "Next" button.

Specify the type of action to be taken when an inbound request matches the rules you configured, and click the "Next" button.

Parameter	Description
Allow the connection	Allow connections that match the conditions of this rule. In other words, permit the IP addresses you configured to access the programs, services, or ports specified by the rule. The firewall will not perform any authentication or security checks on such connections.
Allow the connection if it is secure	Allow only connections authenticated and encrypted via IPsec. You can customize the secure connection rules.
Block the connection	Reject and block connections that match the conditions of this rule. In other words, prohibit the IP addresses you configured from accessing the programs, services, or ports specified by the rule. Connection attempts will be discarded directly.

Select the scope for the current rule and click the "Next" button.

tip

By default, all scope options are selected. Select the scope based on the actual network environment.

After you enter the rule name, click the "Finish" button.

Last updated: 2026.06.18 17:49:51