---
title: "Create a security group"
sidebar_label: "Create a security group"
sidebar_position: 1
description: "How to create a security group with rules"
---

import Formbricks from '@theme/MDXComponents/Formbricks';
import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
import { TabItemLabel } from '@selectel/docux/components';
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical';
import CreateRuleIngress from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/security-groups/create-rule-ingress.mdx';
import CreateRuleEgress from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/security-groups/create-rule-egress.mdx';

# Create a security group

При создании группы вы настраиваете только [правила](/cloud-servers/security-groups/about-security-groups.mdx#rules) для входящего трафика. Исходящий трафик по умолчанию разрешен — in группу автоматически добавляются два правила для исходящего трафика, которые нельзя изменить or удалить in ходе создания группы. Эти правила нужны, чтобы при создании сервер мог запросить необходимые данные для своей настройки.

After creating a group, you can [delete any rules](/cloud-servers/security-groups/manage-rules/delete-rule.mdx) in it and [create new ones](/cloud-servers/security-groups/manage-rules/create-rule.mdx). You can [download](/cloud-servers/security-groups/manage-groups/download-rules.mdx) existing group rules, as well as [copy them to another security group](/cloud-servers/security-groups/manage-groups/copy-group.mdx).

In the Control Panel, you can create a group with the stateful mode and [rule](/cloud-servers/security-groups/about-security-groups.mdx#rules) protocols: TCP, UDP, ICMP, or Any (all protocols). Via the OpenStack CLI, you can create a group with stateful or stateless mode and any rule protocol.

You can also [copy an existing security group](/cloud-servers/security-groups/manage-groups/copy-group.mdx).

<Tabs queryString="create-group">
  <TabItem value="panel">
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/security-groups), on the top menu, click **Products** and select **Cloud Servers**.

    2. Go to the **Security Groups** section.

    3. Click **Create security group**.

    4. Select a [location](/infrastructure/locations.mdx) where the group will be created. The group can only be assigned to ports in the same location.

    5. Create rules for incoming traffic. To do this, in the **Incoming traffic** block:

       5.1. If one of the incoming traffic rule templates suits your needs, click the template name. The protocol, source, source ports, traffic destination, and destination port fields will be filled in automatically. Go to step 6.

       5.2. If the templates do not fit, add your own incoming traffic rule. Click **Add incoming traffic rule**.

       5.3. Select a protocol or click **All protocols**.

       5.4. Specify the traffic source (Source):

       * for traffic from an IP address or subnet — select **CIDR** and enter the IP address or subnet, or click **All sources**;
       * for traffic from a security group — select **Security group** and select a group. Security groups in the same pool are available. If you need to accept traffic from another pool, specify the source CIDR.

       5.5. Enter the port to which traffic is allowed (Dst. port) — a single port or a port range, or click **All ports**.

       5.6. Optional: enter a comment for the rule.

       5.7. Click **Add**. After the group is created, the rule cannot be modified; you can [delete the rule](/cloud-servers/security-groups/manage-rules/delete-rule.mdx) and [create a new one](/cloud-servers/security-groups/manage-rules/create-rule.mdx).

       5.8. To add another rule, repeat steps 5.2–5.7.

    6. Optional: in the **Ports** block, select the ports to which the security group will be assigned. Available ports are those with [traffic filtering (port security](/cloud-servers/cloud-networks/about-networks.mdx#traffic-filtering-port-security)) enabled that are not connected to devices or are connected to a cloud server. After the group is created, all active sessions on the selected ports that do not comply with the group rules will be dropped.

    7. Enter a group name or leave the automatically generated name.

    8. Optional: enter a comment for the group.

    9. Click **Create security group**.

    10. Optional: restrict outgoing traffic; to do this, [delete the outgoing traffic rules](/cloud-servers/security-groups/manage-rules/delete-rule.mdx) that were created with the group, and [create new ones](/cloud-servers/security-groups/manage-rules/create-rule.mdx).
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Create a security group:

       ```bash
       openstack security group create \
           [--description "<description>"] \
           [--stateless] \
           <security_group_name>
       ```

       Specify:

       * optional: `--description "<description>"` — security group description. The `<description>` — description text;
       * optional: group mode — `--stateful` or `--stateless`. If the mode is not specified, a stateful group is created;
       * `<security_group_name>` — security group name.

    3. Create a rule in the group:

       <Tabs queryString="create-group-rule">
         <TabItem value="ingress">
           <TabItemLabel>
             Incoming traffic
           </TabItemLabel>

           <CreateRuleIngress />
         </TabItem>

         <TabItem value="egress">
           <TabItemLabel>
             Outgoing traffic
           </TabItemLabel>

           <CreateRuleEgress />
         </TabItem>
       </Tabs>

    4. Optional: create another rule in the group; to do this, repeat step 3.

    5. Optional: check the list of rules in the security group:

       ```bash
       openstack security group rule list <security_group>
       ```

       Specify `<security_group>` — the ID or name of the security group you created in step 2. You can view the list using the `openstack security group list` command.
  </TabItem>
</Tabs>

<Formbricks />