Example of configuring security groups for cloud servers in the same subnet

Last update: October 05 2026Open in Markdown

Configuration goal

Configure security groups for two cloud servers to restrict the servers' access to each other and access to the servers from the internet.

Requirements

In the configuration example, we used two cloud servers located in the same pool:

• a web server is deployed on one server, and the server is connected to the internet via a public floating IP address;
• the other server is running a MySQL database that accepts requests from the web server on the standard port 3306.

The servers are added to the same private subnet. In the private network and on the server ports in this network, traffic filtering (port security) is enabled.

Configuration result

Two security groups have been created and assigned to the server ports:

• for the web server — the group allows incoming HTTP and HTTPS traffic from the internet;
• for the database server — the group allows incoming traffic from the web server on the database's standard port.

All outgoing traffic from the servers is allowed.

Configuration steps

Control panel

1. Create a security group for the web server.
2. Create a security group for the database server.

1. Create a security group for the web server

1. In the Control panel, in the top menu, click Products and select Cloud Servers.

2. Go to Security groups.

3. Click Create security group.

4. Select the location where the web server is located.

5. Create a rule that allows incoming HTTP traffic for the web server:

   5.1. Click Add inbound traffic rule.

   5.2. Select the protocol — TCP.

   5.3. Select traffic source (Source) — CIDR and enter the default subnet IP address 0.0.0.0/0.

   5.4. Enter the port (Dst. port) allowed to receive traffic — 80.

   5.5. Optional: enter a comment for the rule.

   5.6. Click Add.

6. Create a rule that allows HTTPS traffic for the web server:

   6.1. Click Add inbound traffic rule.

   6.2. Select the protocol — TCP.

   6.3. Select traffic source (Source) — CIDR and enter the default subnet IP address 0.0.0.0/0.

   6.4. Enter the port (Dst. port) allowed to receive traffic, in the example — 443.

   6.5. Optional: enter a comment for the rule.

   6.6. Click Add.

7. In the Ports block, select the web server port to which the security group will be assigned. After the group is created, all active sessions on the port that do not match the group rules will be terminated.

8. Enter a group name or leave the name created automatically.

9. Optional: enter a comment for the group.

10. Click Create security group.

2. Create a security group for the database server

1. In the Control panel, in the top menu, click Products and select Cloud Servers.

2. Go to Security groups.

3. Click Create security group.

4. Select the location where the database server is located.

5. Create a rule that allows incoming traffic from the web server group:

   5.1. Click Add inbound traffic rule.

   5.2. Select the protocol — TCP.

   5.3. Select traffic source (Source) — SG and select the security group you created for the web server.

   5.4. Enter the port (Dst. port) allowed to receive traffic — 3306.

   5.5. Optional: enter a comment for the rule.

   5.6. Click Add.

6. In the Ports block, select the web server port to which the security group will be assigned. After the group is created, all active sessions on the port that do not match the group rules will be terminated.

7. Enter a group name or leave the name created automatically.

8. Optional: enter a comment for the group.

9. Click Create security group.

OpenStack CLI

1. Open the OpenStack CLI.

2. Create a security group for the web server:

   openstack security group create \
       --description "<description_1>" \
       <security_group_name_1>

   Specify:

   • <description_1> — security group description, for example, Allow internet traffic for web server;
   • <security_group_name_1> — security group name, for example, web.

   The group will be created with two rules allowing all outgoing traffic.

3. Create a rule that allows incoming HTTP traffic for the web server:

   openstack security group rule create \
       --protocol tcp --dst-port 80 \
       --remote-ip 0.0.0.0/0 \
       <security_group_1>

   Specify <security_group_1> — ID or name of the security group created for the web server in step 2; can be viewed using the command openstack security group list.

4. Create a rule that allows HTTPS traffic for the web server:

   openstack security group rule create \
       --protocol tcp --dst-port 443 \
       --remote-ip 0.0.0.0/0 \
       <security_group_1>

   Specify <security_group_1> — ID or name of the security group created for the web server in step 2; can be viewed using the command openstack security group list.

5. Create a security group for the database server:

   openstack security group create \
       --description "<description_2>" \
       <security_group_name_2>

   Specify:

   • <description_2> — security group description, for example, Allow traffic from web server group;
   • <security_group_name_2> — security group name, for example, database.

   The group will be created with two rules allowing all outgoing traffic.

6. Create a rule that allows incoming traffic from the web server group:

   openstack security group rule create \
       --protocol <protocol> --dst-port <port> \
       --remote-group <security_group_1> \
       <security_group_2>

   Specify:

   • <protocol> — protocol, in the example — tcp;
   • <port> — port on the database server allowed to receive traffic, in the example — 3306;
   • <security_group_1> — ID or name of the security group you created for the web server in step 2; can be viewed using the command openstack security group list;
   • <security_group_2> — ID or name of the security group you created for the database server in step 5.

7. Assign the security group you created in step 2 to the web server port:

   openstack port set \
       --security-group <security_group> \
       <port_1>

   Specify:

   • <security_group> — ID or name of the security group created in step 2; can be viewed using the command openstack security group list;
   • <port_1> — ID or name of the web server port from the private subnet; can be viewed using the command openstack port list.

8. Assign the security group you created in step 5 to the database server port:

   openstack port set \
       --security-group <security_group> \
       <port_2>

   Specify:

   • <security_group> — ID or name of the security group you created in step 5; can be viewed using the command openstack security group list;
   • <port_2> — ID or name of the database server port from the private subnet; can be viewed using the command openstack port list.

9. Optional: check the created groups:

   openstack security group list

10. Optional: check the list of rules in the group:

    openstack security group rule list <security_group>

    Specify <security_group> — ID or name of the group whose rules you want to view; can be viewed using the command openstack security group list.

Terraform

Use the instructions Create security group and assign it to server port in the Terraform documentation.