---
title: "Ports"
sidebar_label: "Ports"
sidebar_position: 5
description: "How to add a port to a subnet, add a cloud server to a subnet, connect a public floating IP address to a port in a private subnet, and other instructions"
toc_max_heading_level: 6
---

import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from 'docs-kit/components'
import MoreVerticalIcon from 'docs-kit/icons/more-vertical'
import EditIcon from 'docs-kit/icons/edit'
import CheckIcon from 'docs-kit/icons/check'
import CopyIcon from 'docs-kit/icons/copy'
import ShieldOkIcon from 'docs-kit/icons/shield-ok'
import TrashIcon from 'docs-kit/icons/trash'
import ConnectDirectIpToCloudServer from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/cloud-networks/connect-direct-ip-to-cloud-server.mdx'
import Formbricks from '@theme/MDXComponents/Formbricks'

# Ports

A port is a virtual network interface card to which a combination of a MAC address and an IP address is assigned. Ports are used to connect a device to a private network or the internet.

A port can be in a private or public subnet.For internet access, instead of adding a port to a subnet, you can also create a port with a separate IP address — a direct public IP address.

Port traffic can only be sent from the single IP/MAC address pair assigned when [adding a port to a subnet](/cloud-servers/cloud-networks/ports.mdx#add-port-to-subnet); traffic from other addresses is dropped. To allow traffic from addresses not specified on the port, you must [add authorized IP/MAC addresses to the port](#add-allowed-ip-mac-addresses-on-port). You cannot add authorized IP/MAC addresses to ports with a direct public IP address.

You can manage subnet ports in the [Control panel](https://my.selectel.ru/vpc/default/networks/), using the [OpenStack CLI](/cloud-servers/tools/openstack-cli/), or [Terraform](/terraform/providers/). You can manage ports with direct public IP addresses in the [Control panel](https://my.selectel.ru/vpc/default/networks/) and using the [OpenStack CLI](/cloud-servers/tools/openstack-cli/).

Service ports are automatically created in cloud networks; they cannot be managed:

* two DHCP ports in a private subnet. They are created when [enabling DHCP in a subnet](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx#enable-dhcp-in-private-subnet) and deleted when [disabling DHCP](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx#disable-dhcp-in-private-subnet);
* two DNS ports in a private subnet. They are created when [connecting a network to a private DNS resolver](/cloud-servers/private-dns/manage-network-dns-setting.mdx#connect-network-to-dns-resolver), and deleted when disconnecting the private network from the private DNS resolver;
* three service ports for networking equipment in a subnet that is connected to a global router. These are created when [connecting a private network to a global router](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx#connect-private-network-to-global-router) and are deleted when [disconnecting a private network from a global router](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx#disconnect-private-network-from-global-router) or when [deleting a global router](/global-router/router/delete-router.mdx);
* VRRP ports and downlinks (redundancy ports) in private subnets where a load balancer is located. The number of service ports depends on the load balancer type; read more about [load balancer ports](/cloud-servers/load-balancers/about-load-balancers.mdx#balancer-ports);
* a port in the private subnet where the [file storage](/file-storage/about/about-file-storage.mdx) is located. It is created together with the subnet for the file storage and can only be deleted with the storage.

## Add a port to a public or private subnet \{#add-port-to-subnet}

<Tabs queryString="add-port-to-subnet">
  <TabItem value="private" default>
    <TabItemLabel>
      Private subnet
    </TabItemLabel>

    <Tabs queryString="add-port-to-private-subnet">
      <TabItem value="panel" default>
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Private networks** tab.

        3. Open the network page → **Ports** tab.

        4. Click **Add port**.

        5. Select a subnet.

        6. Enter the port IP address.

        7. Optional: select a server or a Managed Kubernetes cluster node to which you want to add this port.

        8. Click **Add port**.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
        2. Create a port in the subnet:

           ```bash
           openstack port create \
             --network <network> \
             --fixed-ip subnet=<subnet>,ip-address=<port_ip_address> \
             <port_name>
           ```

           Specify:

           * `<network>` — private network ID or name, can be viewed using the `openstack network list`;
           * `<subnet>` — ID or name of the subnet; you can view it using the `openstack subnet list` command;
           * `<port_ip_address>` — port IP address;
           * `<port_name>` — port name.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="public-subnet">
    <TabItemLabel>
      Public subnet
    </TabItemLabel>

    <Tabs queryString="add-port-to-public-subnet">
      <TabItem value="panel" default>
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Public networks** tab.

        3. Open the subnet card → **Ports** tab.

        4. Click **Add port**.

        5. Select a subnet.

        6. Enter the port IP address.

        7. Click **Add port**.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
        2. Create a port in the subnet:

           ```bash
           openstack port create \
             --network <network> \
             --fixed-ip subnet=<subnet>,ip-address=<port_ip_address> \
             <port_name>
           ```

           Specify:

           * `<network>` — ID or name of the public network; matches the `<subnet>` parameter; you can view it using the `openstack subnet list` command;
           * `<subnet>` — ID or name of the subnet; you can view it using the `openstack subnet list` command;
           * `<port_ip_address>` — port IP address;
           * `<port_name>` — port name.
      </TabItem>
    </Tabs>
  </TabItem>
</Tabs>

## Add a port with a direct public IP address to a cloud server \{#add-port-with-direct-ip-to-cloud-server}

After creation, you can add a port with a direct public IP address to a cloud server.

<ConnectDirectIpToCloudServer />

## Add a cloud server or a Managed Kubernetes cluster node to a subnet via a port \{#add-cloud-server-to-subnet-via-port}

A cloud server can be added to a private subnet or a public subnet. A Managed Kubernetes cluster node can be added to a private subnet.

To do this, you need to add a port to the server or node.

<Tabs queryString="add-cloud-server-to-subnet-via-port">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/servers/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Servers** section.
    3. Open the server page → **Ports** tab.
    4. Click **Add port**.
    5. Select a private or public subnet.
    6. Enter the port IP address.
    7. Click **Add**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Create a port in a subnet:

       ```bash
       openstack port create \
         --network <network> \
         --fixed-ip subnet=<subnet>,ip-address=<port_ip_address> \
         <port_name>
       ```

       Specify:

       * `<network>` — private or public subnet ID or name, can be viewed using the `openstack network list`. For a public subnet, it matches the `<subnet>`;
       * `<subnet>` — ID or name of the subnet; you can view it using the `openstack subnet list` command;
       * `<port_ip_address>` — port IP address;
       * `<port_name>` — port name.

    3. Add a port to a cloud server:

       ```bash
       openstack server add port <server> <port>
       ```

       Specify:

       * `<server>` — ID or name of the cloud server; you can view it using the `openstack server list` command;
       * `<port>` — ID or name of the port; you can view it using the `openstack port list` command.
  </TabItem>
</Tabs>

## Connect a public floating IP address to a port in a private subnet \{#assign-ip-to-port-in-private-subnet}

If a cloud server or load balancer is connected to a port in a private subnet, you can connect a [public floating IP address](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx) to that port.

To connect a public floating IP address in device sections of the Control panel, use the [Public floating IP addresses](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx) instruction.

<Tabs queryString="assign-ip-to-port-in-private-subnet">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. Ensure that the device is in a subnet that meets the requirements; for more details, see the [Prepare a private subnet for connecting a public floating IP address](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx#configure-subnet-for-internet-access) subsection of the [Public floating IP addresses](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx) instruction.
    2. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.
    3. Go to the **Network** section → **Private networks** tab.
    4. Open the network page → **Ports** tab.
    5. In the cloud server or load balancer port card, click **Connect public IP**.
    6. Select a public floating IP address.
    7. Click **Connect**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Connect a public floating IP address to a port:

       ```bash
       openstack floating ip set --port <port> <floating_ip_address>
       ```

       Specify:

       * `<port>` — ID of the cloud server or load balancer port; you can view it using the `openstack port list` command;
       * `<floating_ip_address>` — ID or public floating IP address; you can view it using the `openstack floating ip list` command.
  </TabItem>
</Tabs>

## Disconnect a public floating IP address from a port in a private subnet \{#disconnect-ip-from-port-in-private-subnet}

To disconnect a public floating IP address in device sections of the Control panel, use the [Public floating IP addresses](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx) instruction.

<Tabs queryString="disconnect-ip-from-port-in-private-subnet">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Network** section → **Private networks** tab.
    3. Open the network page → **Ports** tab.
    4. In the cloud server or load balancer port card, next to the public floating IP address, click <EditIcon />.
    5. Select **Disconnect public IP address**.
    6. Optional: if you no longer need the public floating IP address, select the **Delete address** checkbox.
    7. Click **Save**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Disconnect a public floating IP address from a port:

       ```bash
       openstack floating ip unset --port <floating_ip_address>
       ```

       Specify `<floating_ip_address>` — ID or public floating IP address; you can view it using the `openstack floating ip list` command.
  </TabItem>
</Tabs>

## Assign a security group to a port \{#assign-security-group-on-port}

To assign a security group on a cloud server page in the Control panel, use the [Assign a security group](/cloud-servers/security-groups/manage-groups/assign-security-groups.mdx) instruction.

To be able to assign a security group to a port, [traffic filtering (port security](/cloud-servers/cloud-networks/about-networks.mdx#traffic-filtering-port-security)) must be enabled in the port's network. You can view the filtering status in the [Control panel](https://my.selectel.ru/vpc/default/networks): in the top menu, click **Products** → **Cloud Servers** → **Network** → **Private networks** or **Public networks** tab. A network with filtering enabled is marked with <ShieldOkIcon />.

<Tabs queryString="assign-security-group-on-port">
  <TabItem value="private" default>
    <TabItemLabel>
      Private subnet
    </TabItemLabel>

    <Tabs queryString="assign-security-group-on-private-port">
      <TabItem value="panel">
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Private networks** tab.

        3. Open the network page → **Ports** tab.

        4. In the port card, in the security groups field, click <EditIcon />. If selecting a security group is not available, [traffic filtering (port security](/cloud-servers/cloud-networks/about-networks.mdx#traffic-filtering-port-security)) is disabled in the network. To use security groups, [create a new private network](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx#create-private-network).

        5. In the **Security groups** field, select the groups you want to assign to the port, or click **New security group** and [create a group](/cloud-servers/security-groups/manage-groups/create-group.mdx).

        6. Click **Save**.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

        2. Ensure that [traffic filtering (port security](/cloud-servers/cloud-networks/about-networks.mdx#traffic-filtering-port-security)) is enabled in the network — the `port_security_enabled` field should have the value `true`:

           ```bash
           openstack network show <network>
           ```

           Specify `<network>` — ID or name of the network.

           If the `port_security_enabled` field has the value `false`, to use security groups, [create a new private network](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx#create-private-network).

        3. Assign a security group to a port:

           ```bash
           openstack port set \
             --security-group <security_group> \
             <port>
           ```

           Specify:

           * `<security_group>` — ID or name of the security group; you can view it using the `openstack security group list` command;
           * `<port>` — ID or name of the port; you can view it using the `openstack port list` command.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="public-subnet">
    <TabItemLabel>
      Public subnet
    </TabItemLabel>

    <Tabs queryString="assign-security-group-on-public-subnet-port">
      <TabItem value="panel">
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Public networks** tab.

        3. Open the subnet card → **Ports** tab.

        4. In the port line, in the **Security groups** field, click <EditIcon />. If selecting a security group is not available, [traffic filtering (port security](/cloud-servers/cloud-networks/about-networks.mdx#traffic-filtering-port-security)) is disabled in the network. To use security groups, [create a new public subnet](/cloud-servers/cloud-networks/public-subnets.mdx#create-public-subnet).

        5. In the **Security groups** field, select the groups you want to assign to the port, or click **New security group** and [create a group](/cloud-servers/security-groups/manage-groups/create-group.mdx).

        6. Click **Save**.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

        2. Ensure that [traffic filtering (port security](/cloud-servers/cloud-networks/about-networks.mdx#traffic-filtering-port-security)) is enabled in the subnet — the `port_security_enabled` field should have the value `true`:

           ```bash
           openstack subnet show <subnet>
           ```

           Specify `<subnet>` — ID or name of the subnet.

           If the `port_security_enabled` field has the value `false`, to use security groups, [create a new public subnet](/cloud-servers/cloud-networks/public-subnets.mdx#create-public-subnet).

        3. Assign a security group to a port:

           ```bash
           openstack port set \
             --security-group <security_group> \
             <port>
           ```

           Specify:

           * `<security_group>` — ID or name of the security group; you can view it using the `openstack security group list` command;
           * `<port>` — ID or name of the port; you can view it using the `openstack port list` command.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="direct-public-ip">
    <TabItemLabel>
      Direct public IP address
    </TabItemLabel>

    <Tabs queryString="assign-security-group-on-direct-public-ip-port">
      <TabItem value="panel">
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. In the **Servers** section, open the server page → **Ports** tab.

        3. In the port row, in the **Security groups** field, click <EditIcon />.

        4. In the **Security groups** field:

           * select the groups you want to assign to the port;
           * or click **New security group** and [create a group](/cloud-servers/security-groups/manage-groups/create-group.mdx).

        5. Click **Save**.
      </TabItem>
    </Tabs>
  </TabItem>
</Tabs>

## Unassign a security group from a port \{#remove-security-group-from-port}

<Tabs queryString="remove-security-group-from-port">
  <TabItem value="private" default>
    <TabItemLabel>
      Private subnet
    </TabItemLabel>

    <Tabs queryString="remove-security-group-from-private-port">
      <TabItem value="panel">
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Private networks** tab.

        3. Open the network page → **Ports** tab.

        4. In the port card, in the security groups field, click <EditIcon />.

        5. In the **Security groups** field, uncheck the boxes for the groups you want to unassign from the port.

        6. Click **Save**.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

        2. Unassign a security group from a port:

           ```bash
           openstack port unset \
             --security-group <security_group> \
             <port>
           ```

           Specify:

           * `<security_group>` — ID or name of the security group; you can view it using the `openstack security group list` command;
           * `<port>` — ID or name of the port; you can view it using the `openstack port list` command.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="public-subnet" default>
    <TabItemLabel>
      Public subnet
    </TabItemLabel>

    <Tabs queryString="remove-security-group-from-public-subnet-port">
      <TabItem value="panel">
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Public networks** tab.

        3. Open the subnet card → **Ports** tab.

        4. In the port row, in the **Security groups** field, click <EditIcon />.

        5. In the **Security groups** field, uncheck the boxes for the groups you want to unassign from the port.

        6. Click **Save**.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

        2. Unassign a security group from a port:

           ```bash
           openstack port unset \
             --security-group <security_group> \
             <port>
           ```

           Specify:

           * `<security_group>` — ID or name of the security group; you can view it using the `openstack security group list` command;
           * `<port>` — ID or name of the port; you can view it using the `openstack port list` command.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="direct-public-ip">
    <TabItemLabel>
      Direct public IP address
    </TabItemLabel>

    <Tabs queryString="remove-security-group-from-direct-public-ip-port">
      <TabItem value="panel">
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. In the **Servers** section, open the server page → **Ports** tab.

        3. In the port row, in the **Security groups** field, click <EditIcon />.

        4. In the **Security groups** field, uncheck the boxes for the groups you want to unassign from the port.

        5. Click **Save**.
      </TabItem>
    </Tabs>
  </TabItem>
</Tabs>

## Add authorized IP/MAC addresses to a port \{#add-allowed-ip-mac-addresses-on-port}

If [traffic filtering (port security](/cloud-servers/cloud-networks/about-networks.mdx#traffic-filtering-port-security)) is enabled in the network, traffic from the port can only be sent from the single IP/MAC address pair that was assigned when [adding a port to a subnet](/cloud-servers/cloud-networks/ports.mdx#add-port-to-subnet) or [adding a port with a direct public IP address](#add-port-with-direct-ip-to-cloud-server). If traffic is transmitted through the port from addresses not specified on the port, that traffic will be blocked. To allow traffic from addresses not specified on the port, you need to add authorized IP/MAC addresses to the port settings.

For example, if you have manually deployed:

* routing software on a cloud server — you need to authorize all routable networks;
* VPN server on a cloud server — you need to authorize the IP addresses of all VPN clients;
* a Kubernetes cluster with the Calico CNI in Direct routing mode on a cloud server — you need to authorize the entire subnet used in the cluster. For the Flannel CNI, no configuration is required;
* VRRP group of several cloud servers — depending on the VRRP settings, you need to authorize the VIP address or the VIP/MAC address pair of the server on each server.

You can add no more than 10 additional IP/MAC address pairs for a single port. If authorized addresses are no longer needed, you can [remove them from the port](#remove-allowed-ip-mac-addresses-from-port). You cannot add additional addresses to a port with a direct public IP address.

You do not need to configure authorized addresses in [Managed Kubernetes](/managed-kubernetes/) clusters, [Managed Databases](/managed-databases/), [ready-made 1C](/cloud-1c/) cloud, as well as on cloud servers created from images with [applications](https://docs.selectel.ru/cloud-servers/applications/about-applications/). All necessary settings for them have already been made.

<Tabs queryString="add-allowed-ip-mac-addresses-on-port">
  <TabItem value="private" default>
    <TabItemLabel>
      Private subnet, global router subnet
    </TabItemLabel>

    <Tabs queryString="add-allowed-ip-mac-addresses-on-private-port">
      <TabItem value="panel">
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Private networks** tab.

        3. Open the network page → **Ports** tab.

        4. In the port card, in the security groups field, click <EditIcon />.

        5. If you want to allow all IP addresses, click **Allow all IP addresses for VPN**. Traffic from the 0.0.0.0/0 subnet will be allowed with the default port MAC address.

        6. If you want to allow traffic from specific addresses:

           6.1. Click **Add IP/MAC pair**.

           6.2. Enter the IP address or subnet in CIDR format.

           6.3. Enter the MAC address that corresponds to the IP address or leave the default port MAC address. Do not use addresses from the `00:00:5e:00:01:82` – `00:00:5e:00:01:c6` range. These MAC addresses are reserved by Selectel network equipment; using them will block traffic on the cloud server interface.

           6.4. To add another address pair, repeat steps 6.1 — 6.3.

        7. Click **Save**.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

        2. Add allowed addresses to the port:

           ```bash
           openstack port set \
             --allowed-address ip-address=<ip_address>[,mac-address=<mac_address>] \
             <port>
           ```

           Specify:

           * `<ip_address>` — the IP address or subnet. If you want to allow all IP addresses, enter the subnet `0.0.0.0/0`;
           * optionally: `,mac-address=<mac_address>` — the MAC address corresponding to the IP address. The `<mac_address>` parameter is the MAC address value. Do not use addresses from the `00:00:5e:00:01:82` – `00:00:5e:00:01:c6` range. These MAC addresses are reserved by Selectel network equipment; using them will block traffic on the cloud server interface. If you do not specify a MAC address, the primary port MAC address will be used;
           * `<port>` — the port ID or name; you can view it using the `openstack port list` command.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="public-subnet">
    <TabItemLabel>
      Public subnetwork
    </TabItemLabel>

    <Tabs queryString="add-allowed-ip-mac-addresses-on-public-subnet-port">
      <TabItem value="panel">
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Public networks** tab.

        3. Open the subnetwork page → **Ports** tab.

        4. In the port row, in the **Security groups** field, click <EditIcon />.

        5. If you want to allow all IP addresses, click **Allow all IP addresses for VPN**. Traffic from the 0.0.0.0/0 subnet will be allowed with the default port MAC address.

        6. If you want to allow traffic from specific addresses:

           6.1. Click **Add IP/MAC pair**.

           6.2. Enter the IP address or subnet in CIDR format.

           6.3. Enter the MAC address that corresponds to the IP address or leave the default port MAC address. Do not use addresses from the `00:00:5e:00:01:82` – `00:00:5e:00:01:c6` range. These MAC addresses are reserved by Selectel network equipment; using them will block traffic on the cloud server interface.

           6.4. To add another address pair, repeat steps 6.1 — 6.3.

        7. Click **Save**.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

        2. Add allowed addresses to the port:

           ```bash
           openstack port set \
             --allowed-address ip-address=<ip_address>[,mac-address=<mac_address>] \
             <port>
           ```

           Specify:

           * `<ip_address>` — the IP address or subnet. If you want to allow all IP addresses, enter the subnet `0.0.0.0/0`;
           * optionally: `,mac-address=<mac_address>` — the MAC address corresponding to the IP address. The `<mac_address>` parameter is the MAC address value. Do not use addresses from the `00:00:5e:00:01:82` – `00:00:5e:00:01:c6` range. These MAC addresses are reserved by Selectel network equipment; using them will block traffic on the cloud server interface. If you do not specify a MAC address, the primary port MAC address will be used;
           * `<port>` — the port ID or name; you can view it using the `openstack port list` command.
      </TabItem>
    </Tabs>
  </TabItem>
</Tabs>

## Remove allowed IP/MAC addresses from the port \{#remove-allowed-ip-mac-addresses-from-port}

<Tabs queryString="remove-allowed-ip-mac-addresses-from-port">
  <TabItem value="private">
    <TabItemLabel>
      Private subnet
    </TabItemLabel>

    <Tabs queryString="remove-allowed-ip-mac-addresses-from-private-port">
      <TabItem value="panel">
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Private networks** tab.

        3. Open the network page → **Ports** tab.

        4. In the port card, in the security groups field, click <EditIcon />.

        5. In the address pair row, click <TrashIcon />.

        6. Click **Save**.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

        2. Remove the allowed addresses from the port. The IP/MAC address pair assigned when creating the port will remain allowed:

           ```bash
           openstack port set \
             --no-allowed-address \
             <port>
           ```

           Specify `<port>` — the port ID or name; you can view it using the `openstack port list` command.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="public-subnet">
    <TabItemLabel>
      Public subnetwork
    </TabItemLabel>

    <Tabs queryString="remove-allowed-ip-mac-addresses-from-public-subnet-port">
      <TabItem value="panel">
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Public networks** tab.

        3. Open the subnetwork page → **Ports** tab.

        4. In the port row, in the **Security groups** field, click <EditIcon />.

        5. In the address pair row, click <TrashIcon />.

        6. Click **Save**.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

        2. Remove the allowed addresses from the port. One IP/MAC address pair assigned when creating the port will remain allowed:

           ```bash
           openstack port set \
             --no-allowed-address \
             <port>
           ```

           Specify `<port>` — the port ID or name; you can view it using the `openstack port list` command.
      </TabItem>
    </Tabs>
  </TabItem>
</Tabs>

## Enable port \{#enable-port}

<Tabs queryString="enable-port">
  <TabItem value="private" default>
    <TabItemLabel>
      Private subnet
    </TabItemLabel>

    <Tabs queryString="enable-private-port">
      <TabItem value="panel" default>
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Private networks** tab.

        3. Open the network page → **Ports** tab.

        4. In the port card, enable the port.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

        2. Enable the port:

           ```bash
           openstack port set --enable <port>
           ```

           Specify `<port>` — the port ID or name; you can view it using the `openstack port list` command.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="public-subnet">
    <TabItemLabel>
      Public subnetwork
    </TabItemLabel>

    <Tabs queryString="enable-public-subnet-port">
      <TabItem value="panel" default>
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Public networks** tab.

        3. Open the subnetwork page → **Ports** tab.

        4. In the port row, enable the port.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

        2. Enable the port:

           ```bash
           openstack port set --enable <port>
           ```

           Specify `<port>` — the port ID or name; you can view it using the `openstack port list` command.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="direct-public-ip">
    <TabItemLabel>
      Direct public IP address
    </TabItemLabel>

    <Tabs queryString="enable-direct-public-ip-port">
      <TabItem value="panel">
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. In the **Servers** section, open the server page → **Ports** tab.

        3. In the card, enable the port.
      </TabItem>
    </Tabs>
  </TabItem>
</Tabs>

## Disable port \{#disable-port}

<Tabs queryString="disable-port">
  <TabItem value="private" default>
    <TabItemLabel>
      Private subnetwork, global router subnetwork
    </TabItemLabel>

    <Tabs queryString="disable-private-port">
      <TabItem value="panel" default>
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Private networks** tab.

        3. Open the network page → **Ports** tab.

        4. In the port card, disable the port.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

        2. Disable the port:

           ```bash
           openstack port set --disable <port>
           ```

           Specify `<port>` — the port ID or name; you can view it using the `openstack port list` command.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="public-subnet">
    <TabItemLabel>
      Public subnetwork
    </TabItemLabel>

    <Tabs queryString="disable-public-subnet-port">
      <TabItem value="panel" default>
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Public networks** tab.

        3. Open the subnetwork page → **Ports** tab.

        4. In the port row, disable the port.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

        2. Disable the port:

           ```bash
           openstack port set --disable <port>
           ```

           Specify `<port>` — the port ID or name; you can view it using the `openstack port list` command.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="direct-public-ip">
    <TabItemLabel>
      Direct public IP address
    </TabItemLabel>

    <Tabs queryString="disable-direct-public-ip-port">
      <TabItem value="panel">
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. In the **Servers** section, open the server page → **Ports** tab.

        3. In the card, disable the port.
      </TabItem>
    </Tabs>
  </TabItem>
</Tabs>

## Delete port \{#delete-port}

<Tabs queryString="delete-port">
  <TabItem value="private" default>
    <TabItemLabel>
      Private subnet
    </TabItemLabel>

    <Tabs queryString="delete-private-port">
      <TabItem value="panel" default>
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), on the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Private networks** tab.

        3. Open the network page → **Ports** tab.

        4. In the port <MoreVerticalIcon /> menu, select <TrashIcon /> **Delete port**.

        5. Depending on whether additional actions are required to delete the port, a dialog box will appear:

           * if additional actions are required, a window with a description of the actions will appear. Perform them and return to step 1;
           * if no additional actions are required, a window to confirm deletion will appear. Click **Delete**.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

        2. Delete the port:

           ```bash
           openstack port delete <port>
           ```

           Specify `<port>` — the port ID or name; it can be viewed using the command `openstack port list`.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="public-subnet">
    <TabItemLabel>
      Public subnet
    </TabItemLabel>

    <Tabs queryString="delete-public-subnet-port">
      <TabItem value="panel" default>
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), in the top menu, click **Products** and select **Cloud Servers**.

        2. Go to the **Network** section → **Public networks** tab.

        3. Open the subnet card → **Ports** tab.

        4. If the <TrashIcon /> button is inactive for the port, prepare it for deletion:

           4.1. In the **Connected to** column, check which device the port is connected to.

           4.2. Prepare the port for deletion depending on the device:

           * cloud server — set the server to [status](/cloud-servers/manage/server-statuses.mdx) `ACTIVE`, `PAUSED` or `STOPPED`;
           * any other device — delete the device, the port will be deleted automatically with the device.

        5. Go to the **Network** section → **Public networks** tab.

        6. Open the subnet card → **Ports** tab.

        7. In the port line, click <TrashIcon />.
      </TabItem>

      <TabItem value="openstack">
        <TabItemLabel>
          OpenStack CLI
        </TabItemLabel>

        1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

        2. Delete the port:

           ```bash
           openstack port delete <port>
           ```

           Specify `<port>` — the port ID or name; it can be viewed using the command `openstack port list`.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="direct-public-ip">
    <TabItemLabel>
      Direct public IP address
    </TabItemLabel>

    A port can only be deleted together with the direct public IP address assigned to it.

    <Tabs queryString="delete-direct-public-ip-port">
      <TabItem value="panel" default>
        <TabItemLabel>
          Control panel
        </TabItemLabel>

        1. In the [Control panel](https://my.selectel.ru/vpc/default/networks/), in the top menu, click **Products** and select **Cloud Servers**.

        2. In the **Servers** section, open the server page → **Ports** tab.

        3. In the port card, click <TrashIcon />.

        4. Optional: to delete the direct public IP address together with the port, select the checkbox.

        5. Click **Delete** to confirm deletion.
      </TabItem>
    </Tabs>
  </TabItem>
</Tabs>

<Formbricks />