Skip to main content

Security groups overview

A security group is a set of traffic filtering rules applied to ports of cloud servers within a single pool.

Unlike a cloud firewall, it allows filtering all server traffic. A cloud firewall is assigned to a cloud router port, so it does not filter traffic between devices in the same network and subnet, as well as traffic to addresses from public subnets and direct public IP addresses.

Security groups are not suitable for DDoS protection; use DDoS protection services for this purpose.

You can work with security groups in the Control panel, using the OpenStack CLI or Terraform .

Security groups support user roles and types.

Records of security group operations are saved in audit logs.

How it works

A security group is assigned to one or all ports of a cloud server and filters incoming and outgoing port traffic according to specified rules. If there are no rules in the group, all traffic is dropped.

For security groups to work, traffic filtering (port security) must be enabled in the network.

Security groups use OpenStack model objects:

  • Security Group — security group. Serves as a container for rules that allow traffic;
  • Rule — a rule in a security group. Allows traffic with specific parameters.

A security group can operate in one of the modes:

  • stateful (default) — session state aware. If traffic has passed through the port and a session is established, return traffic within that session will pass even without a rule. Session timeout is 300 seconds;
  • stateless — session state is not tracked.

You can specify the mode when creating a group and change the mode after creating the group.

Multiple security groups can operate on a single port. Their rules apply simultaneously: if traffic matches at least one rule, it will be allowed.

Default security group

In a single project, a default security group named default is created for each pool. If traffic filtering (port security) is enabled in the network, the default security group is assigned to all ports in that network when they are created. For a cloud server, you can assign a different security group when creating a port or server.

The default security group allows all incoming and outgoing traffic for allowed port IP addresses and operates in stateful mode. To restrict traffic using the default group, you can manage rules in it — delete rules and add new ones.

Do not delete rules in the default security group if a Managed Kubernetes cluster is running in the project and pool of this group. Any changes to the default group may lead to cluster failures.

The default group cannot be deleted.

Rules

Rules operate on an allowlist basis: if traffic matches at least one rule in the group, it will be allowed. The order of rules does not matter.

A rule allows traffic based on request parameters:

  • direction — incoming or outgoing;
  • protocol — TCP, UDP, ICMP, AH, DCCP, EGP, ESP, GRE, IGMP, IPv6-ENCAP, IPv6-Frag, IPv6-ICMP, IPv6-NoNxt, IPv6-Opts, IPv6-Route, OSPF, PGM, RSVP, SCTP, UDP Lite, VRRP, IP-in-IP, or any protocol;
  • port (for incoming and outgoing traffic) — a port or port range with which a connection can be established. Specifies ports on the device to which the group with the rule is assigned;
  • traffic source (for incoming traffic) — an IP address, subnet, or another security group;
  • traffic destination (for outgoing traffic) — an IP address, subnet, or another security group.

When creating a security group, two rules allowing all outgoing traffic are created by default. These rules are needed so that upon creation the server can request the necessary data for its configuration. You can delete these rules and add new ones. Rules from a group can be downloaded as well as copied to another security group.

Limits

Within a single pool in a project, you can create:

The number of security groups and rules on a single port is restricted by the project limit: no more than 20 groups and no more than 200 rules.

In Selectel, certain TCP/UDP ports are blocked by default. If incoming or outgoing traffic through a port is blocked by default, it will not pass even if there is an allow rule.

Cost

Security groups are provided free of charge.