nas-tools/fix_nsg_rules.md

Fix Network Security Group (NSG) Rules

The Problem

Your instance has a Network Security Group (NSG) called ig-quick-action-NSG that might be blocking traffic even though Security List rules are added.

Oracle Cloud has two firewall layers:

1. Security Lists (VCN level) - ✅ You added rules here
2. Network Security Groups (NSG) (Instance level) - ❌ Might be blocking!

Solution: Add Rules to NSG

Step 1: Go to Network Security Group

From your instance details page (where you saw the VNIC info):

1. Find "Network security groups" section
2. Click on "ig-quick-action-NSG" (the blue link)
3. This opens the NSG details page

Step 2: Add Ingress Rules

1. Click on "Ingress Rules" tab
2. Click "Add Ingress Rules"
3. Add the same 4 rules:

Rule 1:

• Source Type: CIDR
• Source CIDR: 0.0.0.0/0
• IP Protocol: TCP
• Destination Port Range: 7890
• Description: Clash HTTP Proxy

Rule 2:

• Source Type: CIDR
• Source CIDR: 0.0.0.0/0
• IP Protocol: TCP
• Destination Port Range: 7891
• Description: Clash SOCKS5

Rule 3:

• Source Type: CIDR
• Source CIDR: 0.0.0.0/0
• IP Protocol: TCP
• Destination Port Range: 7892
• Description: Clash Mixed

Rule 4:

• Source Type: CIDR
• Source CIDR: 0.0.0.0/0
• IP Protocol: TCP
• Destination Port Range: 9090
• Description: Clash Web UI

Step 3: Save and Test

1. Click "Add Ingress Rules"
2. Wait 30-60 seconds
3. Test again: curl --proxy http://proxy_user:Cs7yBx1Rh9oK@158.101.140.85:7890 http://httpbin.org/ip

Alternative: Remove NSG (If Not Needed)

If you don't need the NSG:

1. Go to instance → Primary VNIC
2. Click "Edit" next to Network security groups
3. Remove ig-quick-action-NSG
4. Save

Then Security List rules will be enough.

Quick Path

Instance Details → Primary VNIC → Network security groups → ig-quick-action-NSG → Ingress Rules → Add Ingress Rules