---
title: "Assign a security group"
sidebar_label: "Assign a security group"
description: "How to assign a security group when creating a port, to an existing port, or when creating a server"
sidebar_position: 3
toc_max_heading_level: 2
---

import Formbricks from '@theme/MDXComponents/Formbricks';
import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
import { TabItemLabel } from '@selectel/docux/components';
import EditIcon from '@selectel/docux/icons/edit';
import ShieldOkIcon from '@selectel/docux/icons/shield-ok';
import TrashIcon from '@selectel/docux/icons/trash';
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical';

# Assign a security group

To be able to assign a security group to a port, [traffic filtering (port security](/cloud-servers/cloud-networks/about-networks.mdx#traffic-filtering-port-security)) must be enabled on the port network. You can check the filtering state of a network in the [Control panel](https://my.selectel.ru/vpc/default/networks): on the top menu, click **Products** → **Cloud Servers** → **Network** → **Private networks** or **Public networks** tab. A network with enabled filtering is marked .<ShieldOkIcon />

When a port is created, a [default security group](/cloud-servers/security-groups/about-security-groups.mdx#default-security-group) named `default` is assigned to it. You can also specify a different security group when creating a port or server; it will be assigned instead of the default group.

You can assign a security group:

* to a port — [when creating a port](#assign-security-group-on-new-port) or [to an existing cloud server port](#assign-security-group-on-existing-port);
* to a server — [when creating a server](#assign-security-group-on-new-server).

## Assign a security group when creating a port \{#assign-security-group-on-new-port}

You can assign a security group when creating a port only for a port in a public or private subnet. If you are configuring a port with a direct public IP address, first [add the port to the server](/cloud-servers/cloud-networks/ports.mdx#add-port-with-direct-ip-to-cloud-server), then [assign a security group to it](#assign-security-group-on-existing-port).

<Tabs queryString="assign-security-group-on-new-port">
  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Create a port with a security group in a private or public subnet:

       ```bash
       openstack port create \
         --network <network> \
         --fixed-ip subnet=<subnet>,ip-address=<port_ip_address> \
         --security-group <security_group> \
         <port_name>
       ```

       Specify:

       * `<network>` — network ID or name, can be viewed using the `openstack network list` command. For a public subnet, this is the same as the `<subnet>` parameter;
       * `<subnet>` — subnet ID or name, can be viewed using the `openstack subnet list`;
       * `<port_ip_address>` — port IP address;
       * `<security_group>` — security group ID or name, can be viewed using the `openstack security group list`;
       * `<port_name>` — port name.

    3. Add a port to a server:

       ```bash
       openstack server add port <server> <port>
       ```

       Specify:

       * `<server>` — cloud server ID or name, can be viewed using the `openstack server list`;
       * `<port>` — ID or name of the port you created in step 2, can be viewed using the `openstack port list`.
  </TabItem>
</Tabs>

## Assign a group to an existing cloud server port \{#assign-security-group-on-existing-port}

:::warning

After assigning a group to a port, all active sessions that do not comply with the group rules will be dropped.

:::

<Tabs queryString="assign-security-group-on-existing-port">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/servers/), on the top menu, click **Products** and select **Cloud Servers**.

    2. Open the server page → **Ports** tab.

    3. In the port card, in the security groups field, click .<EditIcon />

    4. In the **Security groups** field, select the groups you want to assign to the port, or click **New security group** and [create a group](/cloud-servers/security-groups/manage-groups/create-group.mdx).

    5. Click **Save**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Assign a security group to a port:

       ```bash
       openstack port set \
         --security-group <security_group> \
         <port>
       ```

       Specify:

       * `<security_group>` — security group ID or name, can be viewed using the `openstack security group list`;
       * `<port>` — port ID or name, can be viewed using the `openstack port list`.
  </TabItem>
</Tabs>

## Assign a group when creating a server \{#assign-security-group-on-new-server}

The group will only be assigned to ports created together with the server.

<Tabs queryString="assign-security-group-on-new-server">
  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Create a cloud server in a subnet specifying a security group:

       ```bash
       openstack server create \
         [--image <image> | --volume <volume> | --snapshot <snapshot>] \
         --flavor <flavor> \
         --availability-zone <pool_segment> \
         --nic net-id=<net_uuid> \
         --security-group <security_group> \
         --key-name <key_name> \
         <server_name>
       ```

       Specify:

       * source type:

         * `--image <image>` — to create a server from a [pre-installed](/cloud-servers/images/about-images.mdx#default-images) or [custom image](/cloud-servers/images/about-images.mdx#own-images). The `<image>` parameter — image ID or name, can be viewed using the `openstack image list`;
         * `--volume <volume>` — to create a server from a [network volume](/cloud-servers/volumes/about-network-volumes.mdx). The `<volume>` parameter — disk ID or name, can be viewed using the `openstack volume list`;
         * `--snapshot <snapshot>` — to create a server from a [snapshot](/cloud-servers/volumes/snapshots.mdx). The `<snapshot>` parameter — snapshot ID or name, can be viewed using the `openstack snapshot list`;

       * `<flavor>` — flavor ID or name. Flavors correspond to [cloud server configurations](/cloud-servers/create/configurations.mdx) and determine the number of vCPU, RAM, and the size of the local disk (optional) for the server. You can use fixed-configuration flavors or [create a flavor](/cloud-servers/create/create-flavor.mdx). For example, `1015` — ID for creating a server with a fixed Standard configuration with 4 vCPU, 16 GB RAM in the ru-9 pool. The list of flavors can be viewed using the `openstack flavor list` or in the [Fixed configuration flavor list across all pools](/cloud-servers/create/configurations.mdx#server-flavors-full-list);

       * `<pool_segment>` — [pool segment](/infrastructure/locations.mdx#pool) in which the cloud server will be created, e.g., `ru-9a`. The list of available pool segments can be viewed in the [Availability matrix](/infrastructure/product-availability-by-location.mdx);

       * `<net_uuid>` — ID of the private or public network to which the server will be connected, can be viewed using the `openstack network list`;

       * `<key_name>` — name of the service user SSH key pair. If SSH keys have not been created, [generate them](/cloud-servers/manage/create-and-place-ssh-key.mdx#create-ssh-keys). The list can be viewed using the `openstack keypair list`;

       * `<security_group>` — ID or name of the security group, can be viewed using the `openstack security group list`;

       * optional: `--block-device-mapping vdb=<extra_volume>` — to add an additional disk. The `<extra_volume>` parameter — ID or name of the additional disk, can be viewed using the `openstack volume list`;

       * optional: `--property x_cloud_smt_enabled=false` — disable [Hyper-Threading (SMT](/cloud-servers/about/dedicated-cores.mdx#hyper-threading)). If this parameter is not specified, Hyper-Threading (SMT) will be enabled by default. Can only be used with flavors that support [dedicated cores](/cloud-servers/about/dedicated-cores.mdx). The list of flavors can be viewed in the [Fixed configuration flavor list across all pools](/cloud-servers/create/configurations.mdx#server-flavors-full-list);

       * optional: `--property x_cloud_numa_nodes=1` — place resources on a single NUMA node. Can only be used with flavors that support [dedicated cores](/cloud-servers/about/dedicated-cores.mdx). The list of flavors can be viewed in the [Fixed configuration flavor list across all pools](/cloud-servers/create/configurations.mdx#server-flavors-full-list);

       * optional: `--tag <tag_name> --os-compute-api-version 2.52` — [tag](/cloud-servers/manage/tags.mdx) to add additional information about the server. The `<tag_name>` parameter — tag name;

       * optional: `--tag preemptible --os-compute-api-version 2.72` — tag to create a [preemptible server](/cloud-servers/about/preemptible-servers.mdx);

       * optional: `--user-data <user_data.file>` — to specify a script to be executed upon the first boot of the operating system. The `<user_data.file>` parameter — path to the script in Base64 encoding. Examples of scripts can be viewed in the [User data](/cloud-servers/manage/user-data.mdx) instruction;

       * `<server_name>` — server name.
  </TabItem>
</Tabs>

<Formbricks />