Skip to main content

Create a security group

When creating a group, you configure only rules for inbound traffic. Outbound traffic is allowed by default — two rules for outbound traffic are automatically added to the group, which cannot be modified or deleted during group creation. These rules are required so that the server can request the necessary data for its configuration upon creation.

After creating the group, you can delete any rules in it and create new ones. Rules from a group can be downloaded, as well as copied to another security group.

In the control panel, you can create a group with stateful mode and rule protocols TCP, UDP, ICMP, or Any (all protocols). Using the OpenStack CLI, you can create a group with stateful or stateless mode and any rule protocol.

You can also copy an existing security group.

  1. In the Control panel, in the top menu, click Products and select Cloud Servers.

  2. Go to Security groups.

  3. Click Create security group.

  4. Select the location where the group will be created. The group can only be assigned to ports in the same location.

  5. Create rules for inbound traffic. To do this, in the Inbound traffic block:

    5.1. If one of the inbound traffic rule templates suits your needs, click the template name. The protocol, source, source ports, traffic destination, and destination port fields will be filled in automatically. Go to step 6.

    5.2. If the templates do not suit your needs, add a custom inbound traffic rule. Click Add inbound traffic rule.

    5.3. Select a protocol or click All protocols.

    5.4. Specify the traffic source (Source):

    • for traffic from an IP address or subnet — select CIDR and enter the IP address or subnet, or click All sources;
    • for traffic from a security group — select Security group and select the group. Security groups in the same pool are available. If you need to accept traffic from another pool, specify the source CIDR.

    5.5. Enter the port allowed to accept traffic (Dst. port) — a single port or port range, or click All ports.

    5.6. Optional: enter a comment for the rule.

    5.7. Click Add. After creating the group, the rule cannot be modified, but you can delete the rule and create a new one.

    5.8. To add another rule, repeat steps 5.2–5.7.

  6. Optional: in the Ports block, select the ports to which the security group will be assigned. Available ports include those with enabled traffic filtering (port security) that are not connected to devices or are connected to a cloud server. After the group is created, all active sessions that do not match the group's rules will be terminated on the selected ports.

  7. Enter a group name or keep the automatically generated name.

  8. Optional: enter a comment for the group.

  9. Click Create security group.

  10. Optional: restrict outbound traffic by deleting the outbound traffic rules created with the group and creating new ones.