Skip to main content

Assign a security group

To be able to assign a security group to a port, traffic filtering (port security) must be enabled on the port network. You can check the filtering state of a network in the Control panel: on the top menu, click Products → Cloud Servers → Network → Private networks or Public networks tab. A network with enabled filtering is marked .

When a port is created, a default security group named default is assigned to it. You can also specify a different security group when creating a port or server; it will be assigned instead of the default group.

You can assign a security group:

Assign a security group when creating a port

You can assign a security group when creating a port only for a port in a public or private subnet. If you are configuring a port with a direct public IP address, first add the port to the server, then assign a security group to it.

  1. Open OpenStack CLI.

  2. Create a port with a security group in a private or public subnet:

    openstack port create \
      --network <network> \
      --fixed-ip subnet=<subnet>,ip-address=<port_ip_address> \
      --security-group <security_group> \
      <port_name>

    Specify:

    • <network> — network ID or name, can be viewed using the openstack network list command. For a public subnet, this is the same as the <subnet> parameter;
    • <subnet> — subnet ID or name, can be viewed using the openstack subnet list;
    • <port_ip_address> — port IP address;
    • <security_group> — security group ID or name, can be viewed using the openstack security group list;
    • <port_name> — port name.

  3. Add a port to a server:

    openstack server add port <server> <port>

    Specify:

    • <server> — cloud server ID or name, can be viewed using the openstack server list;
    • <port> — ID or name of the port you created in step 2, can be viewed using the openstack port list.

Assign a group to an existing cloud server port

warning

After assigning a group to a port, all active sessions that do not comply with the group rules will be dropped.

  1. In the Control panel, on the top menu, click Products and select Cloud Servers.

  2. Open the server page → Ports tab.

  3. In the port card, in the security groups field, click .

  4. In the Security groups field, select the groups you want to assign to the port, or click New security group and create a group.

  5. Click Save.

Assign a group when creating a server

The group will only be assigned to ports created together with the server.

  1. Open OpenStack CLI.

  2. Create a cloud server in a subnet specifying a security group:

    openstack server create \
      [--image <image> | --volume <volume> | --snapshot <snapshot>] \
      --flavor <flavor> \
      --availability-zone <pool_segment> \
      --nic net-id=<net_uuid> \
      --security-group <security_group> \
      --key-name <key_name> \
      <server_name>

    Specify:

    • source type:

      • --image <image> — to create a server from a pre-installed or custom image. The <image> parameter — image ID or name, can be viewed using the openstack image list;
      • --volume <volume> — to create a server from a network volume. The <volume> parameter — disk ID or name, can be viewed using the openstack volume list;
      • --snapshot <snapshot> — to create a server from a snapshot. The <snapshot> parameter — snapshot ID or name, can be viewed using the openstack snapshot list;

    • <flavor> — flavor ID or name. Flavors correspond to cloud server configurations and determine the number of vCPU, RAM, and the size of the local disk (optional) for the server. You can use fixed-configuration flavors or create a flavor. For example, 1015 — ID for creating a server with a fixed Standard configuration with 4 vCPU, 16 GB RAM in the ru-9 pool. The list of flavors can be viewed using the openstack flavor list or in the Fixed configuration flavor list across all pools;

    • <pool_segment> — pool segment in which the cloud server will be created, e.g., ru-9a. The list of available pool segments can be viewed in the Availability matrix;

    • <net_uuid> — ID of the private or public network to which the server will be connected, can be viewed using the openstack network list;

    • <key_name> — name of the service user SSH key pair. If SSH keys have not been created, generate them. The list can be viewed using the openstack keypair list;

    • <security_group> — ID or name of the security group, can be viewed using the openstack security group list;

    • optional: --block-device-mapping vdb=<extra_volume> — to add an additional disk. The <extra_volume> parameter — ID or name of the additional disk, can be viewed using the openstack volume list;

    • optional: --property x_cloud_smt_enabled=false — disable Hyper-Threading (SMT). If this parameter is not specified, Hyper-Threading (SMT) will be enabled by default. Can only be used with flavors that support dedicated cores. The list of flavors can be viewed in the Fixed configuration flavor list across all pools;

    • optional: --property x_cloud_numa_nodes=1 — place resources on a single NUMA node. Can only be used with flavors that support dedicated cores. The list of flavors can be viewed in the Fixed configuration flavor list across all pools;

    • optional: --tag <tag_name> --os-compute-api-version 2.52 — tag to add additional information about the server. The <tag_name> parameter — tag name;

    • optional: --tag preemptible --os-compute-api-version 2.72 — tag to create a preemptible server;

    • optional: --user-data <user_data.file> — to specify a script to be executed upon the first boot of the operating system. The <user_data.file> parameter — path to the script in Base64 encoding. Examples of scripts can be viewed in the User data instruction;

    • <server_name> — server name.