ACP-Cloud1 Exam Dumps : ACP Cloud Computing Certification

Before data communication is set up, the security groups match the security group rules one by one to query whether to allow access requests. If the protocol type, port range, authorization type, and authorization object of two security group rules are the same, the following rules apply:

If the two rules have the same priority, the rule of the denial policy takes effect first, and the rule of the allowed policy does not take effect. This is because the security group rules follow the principle of minimum permission, which means that the most restrictive rule is applied when there is a conflict.

If the two rules have different priorities, the rule with a smaller priority number takes effect. This is because the security group rules follow the principle of priority, which means that the rule with a higher priority (lower number) is applied when there is a conflict. References: ECS Security Groups - Alibaba Fundamentals - Cloud Academy, Security group rules - Elastic Compute Service - Alibaba Cloud Documentation Center

When using Alibaba Cloud SLB to forward layer 7 (HTTP) service requests, SLB will replace the IP address in the HTTP header file to forward requests. Therefore, the source IP address that can be seen on the backend ECS instance is the IP address of SLB instead of the client’s real IP address. However, SLB also provides a feature called X-Forwarded-For (XFF) that can help you obtain the real IP address of the client. XFF is a standard HTTP header field that records the original IP address of the client and the proxy servers that the request passes through. You can enable XFF on the SLB console or by using the API, and then configure your backend ECS instance to parse the XFF header field and get the real IP address of the client. References: 1 - SLB overview - Alibaba Cloud Document Center - Layer 7 listeners - X-Forwarded-For

The X-Forwarded-For field in HTTP header is used to identify the originating IP address of a client connecting to a web server through an HTTP proxy or a load balancer. When the “Obtain the Visitor’s Real IP Address” function is enabled in Alibaba Cloud SLB, the SLB instance adds the X-Forwarded-For field to the HTTP header of each request and forwards the request to the backend server. The backend server can then obtain the real IP address of the visitor from the X-Forwarded-For field1. The format of the X-Forwarded-For field is as follows:

X-Forwarded-For: client, proxy1, proxy2

where the value is a comma+space separated list of IP addresses, the left-most being the original client, and each successive proxy that passed the request adding the IP address where it received the request from. In this example, the request passed through proxy1, proxy2, and then the SLB instance (proxy3).2

References: Obtain client IP addresses - Server Load Balancer - Alibaba Cloud, X-Forwarded-For - MDN Web Docs