Skip to main content

Assign a security group

To be able to assign a security group to a port, traffic filtering (port security) must be enabled in the port network. You can check the network filtering status in the control panel: in the top menu, click Products → Cloud servers → Network → Private networks or Public networks tab. A network with filtering enabled is marked with .

When creating a port, the default security group named default is assigned to it. You can also specify a different security group when creating a port or server; it will be assigned instead of the default group.

You can assign a security group:

Assign a security group when creating a port

You can assign a security group when creating a port only to a port in a public or private subnet. If you are configuring a port with a direct public IP address, first add the port to the server, then assign a security group to it.

  1. Open the OpenStack CLI.

  2. Create a port with a security group in a private or public subnet:

    openstack port create \
      --network <network> \
      --fixed-ip subnet=<subnet>,ip-address=<port_ip_address> \
      --security-group <security_group> \
      <port_name>

    Specify:

    • <network> — network ID or name, can be viewed using the command openstack network list. For a public subnet, it is the same as the parameter <subnet>;
    • <subnet> — subnet ID or name, can be viewed using the command openstack subnet list;
    • <port_ip_address> — port IP address;
    • <security_group> — security group ID or name, can be viewed using the command openstack security group list;
    • <port_name> — port name.

  3. Add a port to a server:

    openstack server add port <server> <port>

    Specify:

    • <server> — cloud server ID or name, can be viewed using the command openstack server list;
    • <port> — ID or name of the port you created in step 2, can be viewed using the command openstack port list.

Assign a group to an existing cloud server port

warning

After assigning a group to a port, all active sessions that do not comply with the group rules will be dropped.

  1. In the control panel, in the top menu, click Products and select Cloud servers.

  2. Open the server page → Ports tab.

  3. In the port card, in the security groups field, click .

  4. In the Security groups field, select the groups you want to assign to the port, or click New security group and create a group.

  5. Click Save.

Assign a group when creating a server

The group will only be assigned to ports created together with the server.

  1. Open the OpenStack CLI.

  2. Create a cloud server in a subnet specifying a security group:

    openstack server create \
      [--image <image> | --volume <volume> | --snapshot <snapshot>] \
      --flavor <flavor> \
      --availability-zone <pool_segment> \
      --nic net-id=<net_uuid> \
      --security-group <security_group> \
      --key-name <key_name> \
      <server_name>

    Specify:

    • source type:

      • --image <image> — to create a server from a pre-built or custom image. The <image> parameter is the image ID or name, which can be viewed using the command openstack image list;
      • --volume <volume> — to create a server from a network volume. The <volume> parameter is the volume ID or name, which can be viewed using the command openstack volume list;
      • --snapshot <snapshot> — to create a server from a snapshot. The <snapshot> parameter is the snapshot ID or name, which can be viewed using the command openstack snapshot list;

    • <flavor> — flavor ID or name. Flavors correspond to cloud server configurations and determine the server's vCPU count, RAM, and local disk size (optional). You can use fixed configuration flavors or create a flavor. For example, 1015 is the ID for creating a Standard line fixed configuration server with 4 vCPUs and 16 GB RAM in the ru-9 pool. The list of flavors can be viewed using the command openstack flavor list or in the table List of fixed configuration flavors across all pools;

    • <pool_segment> — the pool segment where the cloud server will be created, for example, ru-9a. The list of available pool segments can be viewed in the instructions Product availability by location;

    • <net_uuid> — ID of the private or public network the server will be connected to, can be viewed using the command openstack network list;

    • <key_name> — name of the service user's SSH key pair. If SSH keys have not been created, generate them. The list can be viewed using the command openstack keypair list;

    • <security_group> — security group ID or name, can be viewed using the command openstack security group list;

    • optional: --block-device-mapping vdb=<extra_volume> — to add an extra volume. The <extra_volume> parameter is the ID or name of the extra volume, which can be viewed using the command openstack volume list;

    • optional: --property x_cloud_smt_enabled=false — disable Hyper-Threading (SMT). If the parameter is not specified, Hyper-Threading (SMT) is enabled by default. Can only be used with flavors that support dedicated cores. The list of flavors can be viewed in the table List of fixed configuration flavors across all pools;

    • optional: --property x_cloud_numa_nodes=1 — place resources on a single NUMA node. Can only be used with flavors that support dedicated cores. The list of flavors can be viewed in the table List of fixed configuration flavors across all pools;

    • optional: --tag <tag_name> --os-compute-api-version 2.52 — a tag to add additional information about the server. The <tag_name> parameter is the tag name;

    • optional: --tag preemptible --os-compute-api-version 2.72 — tag to create a preemptible server;

    • optional: --user-data <user_data.file> — to specify a script to run on the first OS boot. The <user_data.file> parameter is the path to the Base64-encoded script. For example scripts, see the User data instructions;

    • <server_name> — server name.