谷咕云计算

# 檢視例項公網IP資訊  
tccli cvm DescribeInstances --InstanceIds '["ins-xxxxxx"]' --region ap-shanghai  
# 輸出關鍵引數：PublicIpAddresses、PrivateIpAddresses  

# 繫結彈性公網IP  
tccli vpc AssociateAddress --AddressId eip-xxxxxx --InstanceId ins-xxxxxx --Region ap-shanghai  

# 獲取例項關聯的安全組ID  
tccli cvm DescribeInstances --InstanceIds '["ins-xxxxxx"]' --region ap-shanghai | grep SecurityGroupId  

# 查詢安全組入站規則  
tccli vpc DescribeSecurityGroupPolicies --SecurityGroupId sg-xxxxxx --Region ap-shanghai  

{  
  "Ingress": [  
    {  
      "Protocol": "TCP",  
      "Port": "80",  
      "CidrBlock": "0.0.0.0/0",  
      "Action": "ACCEPT"  
    },  
    {  
      "Protocol": "TCP",  
      "Port": "443",  
      "CidrBlock": "::/0",  
      "Action": "ACCEPT"  
    }  
  ]  
}  

# 新增HTTP入站規則（IPv4）  
tccli vpc CreateSecurityGroupPolicies --SecurityGroupId sg-xxxxxx --Region ap-shanghai \  
--SecurityGroupPolicySet.Ingress.0.Protocol=TCP \  
--SecurityGroupPolicySet.Ingress.0.Port=80 \  
--SecurityGroupPolicySet.Ingress.0.CidrBlock=0.0.0.0/0 \  
--SecurityGroupPolicySet.Ingress.0.Action=ACCEPT  

# 檢視iptables規則  
iptables -L -n -v  

# 放行80埠（臨時生效）  
iptables -I INPUT -p tcp --dport 80 -j ACCEPT  

# 持久化規則（CentOS 7+）  
service iptables save  
systemctl restart iptables  

# 或使用firewalld  
firewall-cmd --zone=public --add-port=80/tcp --permanent  
firewall-cmd --reload  

# 檢視防火牆規則  
Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' }  

# 放行80埠  
New-NetFirewallRule -DisplayName "AllowHTTP" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow  

# 檢視埠監聽情況  
netstat -tulnp | grep ':80'  

# 預期輸出（0.0.0.0:80表示允許外網訪問）  
tcp6   0   0 :::80   :::*    LISTEN      1234/nginx: master  

server {  
    listen 80 default_server;  
    listen [::]:80 default_server;  # 監聽IPv6  
    server_name _;  
    # 確保未設定allow/deny IP限制  
}  

# 安裝tcping  
wget https://github.com/mattthias/tcping/releases/download/1.3.3/tcping-1.3.3-linux-amd64 -O /usr/bin/tcping  
chmod +x /usr/bin/tcping  

# 測試外網80埠可達性  
tcping -t 2 1.2.3.4 80  

# 建立流日誌  
tccli vpc CreateFlowLog --FlowLogName BlockedTraffic --ResourceType NETWORKINTERFACE \  
--ResourceId eni-xxxxxx --TrafficType ACCEPT --CloudLogId xxxxxx --Region ap-shanghai  

# 服務端執行（目標為客戶端公網IP）  
mtr -r -c 100 --tcp -P 80 客戶端IP  

# 客戶端執行（目標為伺服器公網IP）  
mtr -r -c 100 --tcp -P 80 伺服器IP  

import json  
from tencentcloud.common import credential  
from tencentcloud.cvm.v20170312 import cvm_client, models  

cred = credential.Credential("SecretId", "SecretKey")  
client = cvm_client.CvmClient(cred, "ap-shanghai")  

req = models.DescribeSecurityGroupsRequest()  
resp = client.DescribeSecurityGroups(req)  

for sg in json.loads(resp.to_json_string())["SecurityGroupSet"]:  
    for policy in sg["SecurityGroupPolicySet"]["Ingress"]:  
        if policy["Port"] == "80" and policy["CidrBlock"] != "0.0.0.0/0":  
            print(f"安全組{sg['SecurityGroupId']} 80埠未開放公網訪問！")