Skip to main content

Create a security group

Last update:

When creating a group, you only configure rules for incoming traffic. Outgoing traffic is allowed by default—two outgoing traffic rules are automatically added to the group, which cannot be modified or deleted during group creation. These rules are necessary so that the server can request the data required for its configuration during creation.

After creating the group, you can delete any rules in it and create new ones. You can download the rules from the group, as well as copy them to another security group.

Through the control panel, you can create a group with stateful mode and rule protocols: TCP, UDP, ICMP, or Any (all protocols). Using the OpenStack CLI, you can create a group with stateful or stateless mode and any rule protocol.

You can also copy an existing security group.

  1. In the control panel, on the top menu, click Products and select Cloud Servers.

  2. Go to the Security Groups section.

  3. Click Create security group.

  4. Select the location where the group will be created. The group can only be assigned to ports in the same location.

  5. Create rules for incoming traffic. To do this, in the Incoming traffic block:

    5.1. If one of the incoming traffic rule templates suits you, click the template name. The protocol, source, source ports, traffic destination, and destination port fields will be filled in automatically. Proceed to step 6.

    5.2. If the templates are not suitable, add your own rule for incoming traffic. Click Add incoming traffic rule.

    5.3. Select a protocol or click All protocols.

    5.4. Specify the traffic source (Source):

    • for traffic from an IP address or subnet—select CIDR and enter the IP address or subnet, or click All sources;
    • for traffic from a security group, select Security Group and select the group. Security groups in the same pool are available. If you need to accept traffic from another pool, specify the source CIDR.

    5.5. Enter the port that is allowed to receive traffic (Dst. port)—a single port or a range of ports—or click All ports.

    5.6. Optional: enter a comment for the rule.

    5.7. Click Add. Once the group is created, the rule cannot be modified; you can delete the rule and create a new one.

    5.8. To add another rule, repeat steps 5.2–5.7.

  6. Optional: in the Ports block, select the ports to which the security group will be assigned. Available ports are those with traffic filtering (port security) enabled that are not connected to devices or are connected to a cloud server. After the group is created, all active sessions on the selected ports that do not comply with the group rules will be terminated.

  7. Enter a group name or leave the name that was created automatically.

  8. Optional: enter a comment for the group.

  9. Click Create security group.

  10. Optional: restrict outgoing traffic; to do this, delete the outgoing traffic rules that were created with the group, and create new ones.