---
title: "Example of configuring security groups for cloud servers in the same subnet"
sidebar_label: "Servers in the same subnet"
sidebar_position: 1
description: "How to configure security groups to restrict traffic exchange for cloud servers in the same private subnet"
toc_max_heading_level: 2
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import TrashIcon from '@selectel/docux/icons/trash'
import {TabItemLabel} from '@selectel/docux/components'

# Example of configuring security groups for cloud servers in the same subnet

## Configuration goal \{#purpose}

Configure security groups for two cloud servers to restrict the servers' access to each other and access to the servers from the internet.

## Requirements \{#what-is-required}

In this configuration example, we used two cloud servers located in the same [pool](/infrastructure/locations.mdx#pool):

* a web server is deployed on one server, the server is connected to the internet via a [public floating IP address](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx);
* the other server is running a MySQL database that accepts requests from the web server on the standard port 3306.

The servers are added to one [private subnet](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx). Traffic filtering (port security) is enabled in the private network and on the server ports in this network.

## Configuration result \{#result}

Two security groups have been created and assigned to the server ports:

* for the web server — the group allows incoming HTTP and HTTPS traffic from the internet;
* for the database server — the group allows incoming traffic from the web server on the database's standard port.

All outgoing traffic from the servers is allowed.

## Configuration steps \{#customization-steps}

<Tabs queryString="customization-steps">
  <TabItem value="panel">
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. [Create a security group for the web server](#create-security-group-for-web-server).
    2. [Create a security group for the database server](#create-security-group-for-database-server).

    ### 1. Create a security group for the web server \{#create-security-group-for-web-server}

    1. In the [Control panel](https://my.selectel.ru/vpc/default/security-groups), on the top menu, click **Products** and select **Cloud Servers**.

    2. Go to the **Security Groups** section.

    3. Click **Create security group**.

    4. Select the [location](/infrastructure/locations.mdx) where the web server is located.

    5. Create a rule that allows incoming HTTP traffic for the web server:

       5.1. Click **Add incoming traffic rule**.

       5.2. Select the protocol — TCP.

       5.3. Select the traffic source (Source) — CIDR and enter the default subnet IP address `0.0.0.0/0`.

       5.4. Enter the port (Dst. port) to accept incoming traffic — `80`.

       5.5. Optional: enter a comment for the rule.

       5.6. Click **Add**.

    6. Create a rule that allows HTTPS traffic for the web server:

       6.1. Click **Add incoming traffic rule**.

       6.2. Select the protocol — TCP.

       6.3. Select the traffic source (Source) — CIDR and enter the default subnet IP address `0.0.0.0/0`.

       6.4. Enter the port (Dst. port) to accept incoming traffic; in this example — `443`.

       6.5. Optional: enter a comment for the rule.

       6.6. Click **Add**.

    7. In the **Ports** block, select the web server port to which the security group will be assigned. Once the group is created, all active sessions on the port that do not comply with the group rules will be terminated.

    8. Enter a group name or leave the name created automatically.

    9. Optional: enter a comment for the group.

    10. Click **Create security group**.

    ### 2. Create a security group for the database server \{#create-security-group-for-database-server}

    1. In the [Control panel](https://my.selectel.ru/vpc/default/security-groups), on the top menu, click **Products** and select **Cloud Servers**.

    2. Go to the **Security Groups** section.

    3. Click **Create security group**.

    4. Select the [location](/infrastructure/locations.mdx) where the database server is located.

    5. Create a rule that allows incoming traffic from the web server group:

       5.1. Click **Add incoming traffic rule**.

       5.2. Select the protocol — TCP.

       5.3. Select the traffic source (Source) — SG and select the security group you [created for the web server](#create-security-group-for-web-server).

       5.4. Enter the port (Dst. port) to accept incoming traffic — `3306`.

       5.5. Optional: enter a comment for the rule.

       5.6. Click **Add**.

    6. In the **Ports** block, select the database server port to which the security group will be assigned. Once the group is created, all active sessions on the port that do not comply with the group rules will be terminated.

    7. Enter a group name or leave the name created automatically.

    8. Optional: enter a comment for the group.

    9. Click **Create security group**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Create a security group for the web server:

       ```bash
       openstack security group create \
           --description "<description_1>" \
           <security_group_name_1>
       ```

       Specify:

       * `<description_1>` — security group description, for example `Allow internet traffic for web server`;
       * `<security_group_name_1>` — security group name, for example `web`.

       The group will be created with two rules allowing all outgoing traffic.

    3. Create a rule that allows incoming HTTP traffic for the web server:

       ```bash
       openstack security group rule create \
           --protocol tcp --dst-port 80 \
           --remote-ip 0.0.0.0/0 \
           <security_group_1>
       ```

       Specify `<security_group_1>` — the ID or name of the security group created for the web server in step 2; you can check it using the `openstack security group list`.

    4. Create a rule that allows HTTPS traffic for the web server:

       ```bash
       openstack security group rule create \
           --protocol tcp --dst-port 443 \
           --remote-ip 0.0.0.0/0 \
           <security_group_1>
       ```

       Specify `<security_group_1>` — the ID or name of the security group created for the web server in step 2; you can check it using the `openstack security group list`.

    5. Create a security group for the database server:

       ```bash
       openstack security group create \
           --description "<description_2>" \
           <security_group_name_2>
       ```

       Specify:

       * `<description_2>` — security group description, for example `Allow traffic from web server group`;
       * `<security_group_name_2>` — security group name, for example `database`.

       The group will be created with two rules allowing all outgoing traffic.

    6. Create a rule that allows incoming traffic from the web server group:

       ```bash
       openstack security group rule create \
           --protocol <protocol> --dst-port <port> \
           --remote-group <security_group_1> \
           <security_group_2>
       ```

       Specify:

       * `<protocol>` — protocol, in this example — `tcp`;
       * `<port>` — port on the database server to accept traffic, in this example — `3306`;
       * `<security_group_1>` — ID or name of the security group you created for the web server in step 2; you can check it using the `openstack security group list`;
       * `<security_group_2>` — ID or name of the security group you created for the database server in step 5.

    7. Assign the security group you created in step 2 to the web server port:

       ```bash
       openstack port set \
           --security-group <security_group> \
           <port_1>
       ```

       Specify:

       * `<security_group>` — ID or name of the security group created in step 2; you can check it using the `openstack security group list`;
       * `<port_1>` — ID or name of the web server port from the private subnet; you can view it using the `openstack port list`.

    8. Assign the security group you created in step 5 to the database server port:

       ```bash
       openstack port set \
           --security-group <security_group> \
           <port_2>
       ```

       Specify:

       * `<security_group>` — ID or name of the security group you created in step 5; you can view it using the `openstack security group list`;
       * `<port_2>` — ID or name of the database server port from the private subnet; you can view it using the `openstack port list`.

    9. Optional: check the created groups:

       ```bash
       openstack security group list
       ```

    10. Optional: check the list of rules in the group:

        ```bash
        openstack security group rule list <security_group>
        ```

        Specify `<security_group>` — ID or name of the group whose rules you want to view; you can view it using the `openstack security group list`.
  </TabItem>

  <TabItem value="terraform">
    <TabItemLabel>
      Terraform
    </TabItemLabel>

    Use the [Create a security group and assign it to a server port](/terraform/examples/security-groups/create-security-group-and-assign-on-server-port/) guide in the Terraform documentation.
  </TabItem>
</Tabs>

<Formbricks />