Ports

Last update: October 05 2026Open in Markdown

A port is a virtual network card assigned with a combination of a MAC address and an IP address. Ports are used to connect a device to a private network or the internet.

A port can be located in a private or public subnet. For internet access, instead of adding a port to a subnet, you can also create a port with a separate IP address — a direct public IP address.

Port traffic can only be sent from one IP/MAC address pair assigned when adding a port to a subnet; traffic from other addresses is dropped. To allow traffic from addresses not specified on the port, you need to add allowed IP/MAC addresses to the port. Allowed IP/MAC addresses cannot be added for ports with a direct public IP address.

You can manage subnet ports in the Control Panel, using the OpenStack CLI, or with Terraform. You can manage ports of direct public IP addresses in the Control Panel and using the OpenStack CLI.

Service ports are automatically created in cloud networks; they cannot be managed:

• two DHCP ports in a private subnet. Created when enabling DHCP in a subnet and deleted when disabling DHCP;
• two DNS ports in a private subnet. Created when connecting a network to a private DNS resolver and deleted when disconnecting a private network from a private DNS resolver;
• three service ports for network equipment in a subnet connected to a global router. Created when connecting a private network to a global router⁠ and deleted when disconnecting a private network from a global router or when deleting a global router;
• VRRP ports and downlinks (ports for redundancy) in private subnets where the load balancer resides. The number of service ports depends on the load balancer type, learn more about load balancer ports;
• a port in a private subnet where File Storage resides. Created along with the subnet for file storage and can only be deleted with the storage.

Add a port to a public or private subnet

Private subnet

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Private networks tab.

3. Open the network page → Ports tab.

4. Click Add port.

5. Select a subnet.

6. Enter the port IP address.

7. Optional: select a server or a Managed Kubernetes cluster node to which you want to add this port.

8. Click Add port.

OpenStack CLI

1. Open the OpenStack CLI.

2. Create a port in the subnet:

   openstack port create \
     --network <network> \
     --fixed-ip subnet=<subnet>,ip-address=<port_ip_address> \
     <port_name>

   Specify:

   • <network> — ID or name of the private network, can be viewed using the command openstack network list;
   • <subnet> — ID or name of the subnet, can be viewed using the command openstack subnet list;
   • <port_ip_address> — port IP address;
   • <port_name> — port name.

Public subnet

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Public networks tab.

3. Open the subnet card → Ports tab.

4. Click Add port.

5. Select a subnet.

6. Enter the port IP address.

7. Click Add port.

OpenStack CLI

1. Open the OpenStack CLI.

2. Create a port in the subnet:

   openstack port create \
     --network <network> \
     --fixed-ip subnet=<subnet>,ip-address=<port_ip_address> \
     <port_name>

   Specify:

   • <network> — ID or name of the public network, matches the <subnet> parameter, can be viewed using the command openstack subnet list;
   • <subnet> — ID or name of the subnet, can be viewed using the command openstack subnet list;
   • <port_ip_address> — port IP address;
   • <port_name> — port name.

Add a port with a direct public IP address to a cloud server

After creation, you can add a port with a direct public IP address to a cloud server.

Control panel

1. In the control panel, in the top menu, click Products and select Cloud Servers.
2. In the Servers section, open the server page → Ports tab.
3. Click Add port.
4. In the Subnet field, select Direct public IP address.
5. Select an existing IP address or click New IP address.
6. Click Add.

Add a cloud server or a Managed Kubernetes cluster node to a subnet via a port

A cloud server can be added to a private subnet or a public subnet. A Managed Kubernetes cluster node can be added to a private subnet.

To do this, you need to add a port to the server or node.

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.
2. Go to the Servers section.
3. Open the server page → Ports tab.
4. Click Add port.
5. Select a private or public subnet.
6. Enter the port IP address.
7. Click Add.

OpenStack CLI

1. Open the OpenStack CLI.

2. Create a port in a subnet:

   openstack port create \
     --network <network> \
     --fixed-ip subnet=<subnet>,ip-address=<port_ip_address> \
     <port_name>

   Specify:

   • <network> — ID or name of the private or public subnet, can be viewed using the command openstack network list. For a public subnet, it matches the <subnet> parameter;
   • <subnet> — ID or name of the subnet, can be viewed using the command openstack subnet list;
   • <port_ip_address> — port IP address;
   • <port_name> — port name.

3. Add a port to a cloud server:

   openstack server add port <server> <port>

   Specify:

   • <server> — ID or name of the cloud server, can be viewed using the command openstack server list;
   • <port> — ID or name of the port, can be viewed using the command openstack port list.

Connect a public floating IP address to a port in a private subnet

If a cloud server or a load balancer is connected to a port in a private subnet, you can connect a public floating IP address to the port.

To connect a public floating IP address in the device sections in the Control Panel, use the Public floating IP addresses instructions.

Control panel

1. Make sure the device is located in a subnet that meets the requirements; for details, see the Prepare a private subnet to connect a public floating IP address⁠⁠ subsection of the Public floating IP addresses instructions.
2. In the Control Panel, in the top menu, click Products and select Cloud Servers.
3. Go to the Network section → Private networks tab.
4. Open the network page → Ports tab.
5. In the cloud server or load balancer port card, click Connect public IP.
6. Select a public floating IP address.
7. Click Connect.

OpenStack CLI

1. Open the OpenStack CLI.

2. Connect a public floating IP address to a port:

   openstack floating ip set --port <port> <floating_ip_address>

   Specify:

   • <port> — ID of the cloud server or load balancer port, can be viewed using the command openstack port list;
   • <floating_ip_address> — ID or public floating IP address, can be viewed using the command openstack floating ip list.

Disconnect a public floating IP address from a port in a private subnet

To disconnect a public floating IP address in the device sections in the Control Panel, use the Public floating IP addresses instructions.

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.
2. Go to the Network section → Private networks tab.
3. Open the network page → Ports tab.
4. In the cloud server or load balancer port card, next to the public floating IP address, click .
5. Select Disconnect public IP address.
6. Optional: if you no longer need the public floating IP address, check the Delete address checkbox.
7. Click Save.

OpenStack CLI

1. Open the OpenStack CLI.

2. Disconnect a public floating IP address from a port:

   openstack floating ip unset --port <floating_ip_address>

   Specify <floating_ip_address> — ID or public floating IP address, can be viewed using the command openstack floating ip list.

Assign a security group to a port

To assign a security group on the cloud server page in the Control Panel, use the Assign security group instructions.

To be able to assign a security group to a port, traffic filtering (port security) must be enabled in the port's network. The filtering status in the network can be viewed in the Control Panel: in the top menu, click Products → Cloud Servers → Network → Private networks or Public networks tab. A network with filtering enabled is marked with .

Private subnet

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Private networks tab.

3. Open the network page → Ports tab.

4. In the port card, in the security groups field, click . If the security group selection is unavailable, traffic filtering (port security) is disabled in the network. To use security groups, create a new private network.

5. In the Security groups field, check the groups you want to assign to the port, or click New security group and create a group.

6. Click Save.

OpenStack CLI

1. Open the OpenStack CLI.

2. Make sure that traffic filtering (port security) is enabled in the network — in the port_security_enabled field, the value is true:

   openstack network show <network>

   Specify <network> — ID or name of the network.

   If the value in the port_security_enabled field is false, to use security groups, create a new private network.

3. Assign a security group to a port:

   openstack port set \
     --security-group <security_group> \
     <port>

   Specify:

   • <security_group> — ID or name of the security group, can be viewed using the command openstack security group list;
   • <port> — ID or name of the port, can be viewed using the command openstack port list.

Public subnet

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Public networks tab.

3. Open the subnet card → Ports tab.

4. In the port row, in the Security groups field, click . If the security group selection is unavailable, traffic filtering (port security) is disabled in the network. To use security groups, create a new public subnet.

5. In the Security groups field, check the groups you want to assign to the port, or click New security group and create a group.

6. Click Save.

OpenStack CLI

1. Open the OpenStack CLI.

2. Make sure that traffic filtering (port security) is enabled in the subnet — in the port_security_enabled field, the value is true:

   openstack subnet show <subnet>

   Specify <subnet> — ID or name of the subnet.

   If the value in the port_security_enabled field is false, to use security groups, create a new public subnet.

3. Assign a security group to a port:

   openstack port set \
     --security-group <security_group> \
     <port>

   Specify:

   • <security_group> — ID or name of the security group, can be viewed using the command openstack security group list;
   • <port> — ID or name of the port, can be viewed using the command openstack port list.

Direct public IP address

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. In the Servers section, open the server page → Ports tab.

3. In the port row, in the Security groups field, click .

4. In the Security groups field:

   • select the groups you want to assign to the port;
   • or click New security group and create a group.

5. Click Save.

Unassign a security group from a port

Private subnet

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Private networks tab.

3. Open the network page → Ports tab.

4. In the port card, in the security groups field, click .

5. In the Security groups field, uncheck the groups you want to disconnect from the port.

6. Click Save.

OpenStack CLI

1. Open the OpenStack CLI.

2. Unassign a security group from a port:

   openstack port unset \
     --security-group <security_group> \
     <port>

   Specify:

   • <security_group> — ID or name of the security group, can be viewed using the command openstack security group list;
   • <port> — ID or name of the port, can be viewed using the command openstack port list.

Public subnet

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Public networks tab.

3. Open the subnet card → Ports tab.

4. In the port row, in the Security groups field, click .

5. In the Security groups field, uncheck the groups you want to disconnect from the port.

6. Click Save.

OpenStack CLI

1. Open the OpenStack CLI.

2. Unassign a security group from a port:

   openstack port unset \
     --security-group <security_group> \
     <port>

   Specify:

   • <security_group> — ID or name of the security group, can be viewed using the command openstack security group list;
   • <port> — ID or name of the port, can be viewed using the command openstack port list.

Direct public IP address

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. In the Servers section, open the server page → Ports tab.

3. In the port row, in the Security groups field, click .

4. In the Security groups field, uncheck the groups you want to disconnect from the port.

5. Click Save.

Add authorized IP/MAC addresses to a port

If traffic filtering (port security) is enabled in the network, port traffic can only be sent from one IP/MAC address pair assigned when adding a port to a subnet or adding a port with a direct public IP address. If traffic from addresses not specified on the port is transmitted through the port, such traffic will be blocked. To allow traffic from addresses not specified on the port, you need to add allowed IP/MAC addresses in the port settings.

For example, if you have manually deployed:

• routing software on a cloud server — you need to authorize all routable networks;
• VPN server on a cloud server — you need to authorize the IP addresses of all VPN clients;
• a Kubernetes cluster with the Calico CNI in Direct routing mode on a cloud server — you need to authorize the entire subnet used in the cluster. For the Flannel CNI, no configuration is required;
• VRRP group of several cloud servers — depending on the VRRP settings, you need to authorize the VIP address or the VIP/MAC address pair of the server on each server.

You can add up to 10 additional IP/MAC address pairs for one port. If you no longer need the allowed addresses, you can remove them from the port. Additional addresses cannot be added to a port with a direct public IP address.

Configuring allowed addresses is not required in Managed Kubernetes clusters, Managed Databases, Turnkey 1C Cloud, as well as on cloud servers created from images with applications. All necessary settings for them have already been configured.

Private subnet, global router subnet

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Private networks tab.

3. Open the network page → Ports tab.

4. In the port card, in the security groups field, click .

5. If you want to allow all IP addresses, click Allow all IP addresses for VPN. Traffic from the 0.0.0.0/0 subnet with the default port MAC address will be allowed.

6. If you want to allow traffic from specific addresses:

   6.1. Click Add IP/MAC pair.

   6.2. Enter the IP address or subnet in CIDR format.

   6.3. Enter the MAC address that matches the IP address, or keep the default port MAC address. Do not use addresses from the 00:00:5e:00:01:82 – 00:00:5e:00:01:c6 range. These MAC addresses are reserved by Selectel network equipment, and using them will cause traffic blocking on the cloud server interface.

   6.4. To add another address pair, repeat steps 6.1 — 6.3.

7. Click Save.

OpenStack CLI

1. Open the OpenStack CLI.

2. Add allowed addresses to the port:

   openstack port set \
     --allowed-address ip-address=<ip_address>[,mac-address=<mac_address>] \
     <port>

   Specify:

   • <ip_address> — IP address or subnet. If you want to allow all IP addresses, enter the subnet 0.0.0.0/0;
   • optional: ,mac-address=<mac_address> — MAC address corresponding to the IP address. The <mac_address> parameter is the MAC address value. Do not use addresses from the 00:00:5e:00:01:82 – 00:00:5e:00:01:c6 range. These MAC addresses are reserved by Selectel network equipment, and using them will cause traffic blocking on the cloud server interface. If you do not specify a MAC address, the primary MAC address of the port will be used;
   • <port> — ID or name of the port, can be viewed using the command openstack port list.

Public subnetwork

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Public networks tab.

3. Open the subnet card → Ports tab.

4. In the port row, in the Security groups field, click .

5. If you want to allow all IP addresses, click Allow all IP addresses for VPN. Traffic from the 0.0.0.0/0 subnet with the default port MAC address will be allowed.

6. If you want to allow traffic from specific addresses:

   6.1. Click Add IP/MAC pair.

   6.2. Enter the IP address or subnet in CIDR format.

   6.3. Enter the MAC address that matches the IP address, or keep the default port MAC address. Do not use addresses from the 00:00:5e:00:01:82 – 00:00:5e:00:01:c6 range. These MAC addresses are reserved by Selectel network equipment, and using them will cause traffic blocking on the cloud server interface.

   6.4. To add another address pair, repeat steps 6.1 — 6.3.

7. Click Save.

OpenStack CLI

1. Open the OpenStack CLI.

2. Add allowed addresses to the port:

   openstack port set \
     --allowed-address ip-address=<ip_address>[,mac-address=<mac_address>] \
     <port>

   Specify:

   • <ip_address> — IP address or subnet. If you want to allow all IP addresses, enter the subnet 0.0.0.0/0;
   • optional: ,mac-address=<mac_address> — MAC address corresponding to the IP address. The <mac_address> parameter is the MAC address value. Do not use addresses from the 00:00:5e:00:01:82 – 00:00:5e:00:01:c6 range. These MAC addresses are reserved by Selectel network equipment, and using them will cause traffic blocking on the cloud server interface. If you do not specify a MAC address, the primary MAC address of the port will be used;
   • <port> — ID or name of the port, can be viewed using the command openstack port list.

Remove allowed IP/MAC addresses from the port

Private subnet

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Private networks tab.

3. Open the network page → Ports tab.

4. In the port card, in the security groups field, click .

5. In the address pair row, click .

6. Click Save.

OpenStack CLI

1. Open the OpenStack CLI.

2. Remove the allowed addresses from the port. The IP/MAC address pair assigned when creating the port will remain allowed:

   openstack port set \
     --no-allowed-address \
     <port>

   Specify <port> — ID or name of the port, can be viewed using the command openstack port list.

Public subnetwork

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Public networks tab.

3. Open the subnet card → Ports tab.

4. In the port row, in the Security groups field, click .

5. In the address pair row, click .

6. Click Save.

OpenStack CLI

1. Open the OpenStack CLI.

2. Remove the allowed addresses from the port. One IP/MAC address pair assigned when creating the port will remain allowed:

   openstack port set \
     --no-allowed-address \
     <port>

   Specify <port> — ID or name of the port, can be viewed using the command openstack port list.

Enable port

Private subnet

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Private networks tab.

3. Open the network page → Ports tab.

4. In the port card, enable the port.

OpenStack CLI

1. Open the OpenStack CLI.

2. Enable the port:

   openstack port set --enable <port>

   Specify <port> — ID or name of the port, can be viewed using the command openstack port list.

Public subnetwork

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Public networks tab.

3. Open the subnet card → Ports tab.

4. In the port row, enable the port.

OpenStack CLI

1. Open the OpenStack CLI.

2. Enable the port:

   openstack port set --enable <port>

   Specify <port> — ID or name of the port, can be viewed using the command openstack port list.

Direct public IP address

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. In the Servers section, open the server page → Ports tab.

3. In the card, enable the port.

Disable port

Private subnetwork, global router subnetwork

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Private networks tab.

3. Open the network page → Ports tab.

4. In the port card, disable the port.

OpenStack CLI

1. Open the OpenStack CLI.

2. Disable the port:

   openstack port set --disable <port>

   Specify <port> — ID or name of the port, can be viewed using the command openstack port list.

Public subnetwork

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Public networks tab.

3. Open the subnet card → Ports tab.

4. In the port row, disable the port.

OpenStack CLI

1. Open the OpenStack CLI.

2. Disable the port:

   openstack port set --disable <port>

   Specify <port> — ID or name of the port, can be viewed using the command openstack port list.

Direct public IP address

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. In the Servers section, open the server page → Ports tab.

3. In the card, disable the port.

Delete port

Private subnet

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Private networks tab.

3. Open the network page → Ports tab.

4. In the port menu, select Delete port.

5. Depending on whether additional actions are required to delete the port, a dialog box will appear:

   • if additional actions are required, a window with a description of the actions will appear. Perform them and return to step 1;
   • if no additional actions are required, a confirmation window will appear. Click Delete.

OpenStack CLI

1. Open the OpenStack CLI.

2. Delete the port:

   openstack port delete <port>

   Specify <port> — ID or name of the port, can be viewed using the command openstack port list.

Public subnet

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. Go to the Network section → Public networks tab.

3. Open the subnet card → Ports tab.

4. If the button is disabled for a port, prepare it for deletion:

   4.1. In the Connected to column, see which device the port is connected to.

   4.2. Prepare the port for deletion depending on the device:

   • cloud server — change the server status to ACTIVE, PAUSED, or STOPPED;
   • any other device — delete the device, the port will be deleted automatically with the device.

5. Go to the Network section → Public networks tab.

6. Open the subnet card → Ports tab.

7. In the port row, click .

OpenStack CLI

1. Open the OpenStack CLI.

2. Delete the port:

   openstack port delete <port>

   Specify <port> — ID or name of the port, can be viewed using the command openstack port list.

Direct public IP address

A port can only be deleted together with the direct public IP address assigned to it.

Control panel

1. In the Control Panel, in the top menu, click Products and select Cloud Servers.

2. In the Servers section, open the server page → Ports tab.

3. In the port card, click .

4. Optional: to delete the direct public IP address together with the port, select the checkbox.

5. Click Delete to confirm deletion.