---
title: "Create a security group rule"
sidebar_label: "Create a rule"
sidebar_position: 1
description: "How to create a security group rule"
---
import Formbricks from '@theme/MDXComponents/Formbricks';
import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
import CopyIcon from '@selectel/docux/icons/copy';
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical';
import { TabItemLabel } from '@selectel/docux/components';
import CreateRuleIngress from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/security-groups/create-rule-ingress.mdx';
import CreateRuleEgress from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/security-groups/create-rule-egress.mdx';
# Create a security group rule
You can:
* create rules one by one — [create an ingress traffic rule](#create-rule-ingress) or [an egress traffic rule](#create-rule-egress) via the Control panel or OpenStack CLI;
* [bulk add rules from a file](#batch-add-rules-via-file) — prepare a `.json` file with the descriptions of the required rules and upload it to the Control panel.
You can create a rule with the TCP, UDP, ICMP, or Any (all protocols) protocol through the Control panel by adding a file. Through the OpenStack CLI, you can create a rule with any protocol.
You can also copy rules from one security group to another; to do this, [copy the security group](/cloud-servers/security-groups/manage-groups/copy-group.mdx).
## Create an ingress traffic rule \{#create-rule-ingress}
Control panel
1. In the [Control panel](https://my.selectel.ru/vpc/default/security-groups), from the top menu, click **Products** and select **Cloud Servers**.
2. Go to the **Security Groups** section.
3. Open the security group page.
4. Open the **Ingress** tab.
5. Click **Create rule**.
6. If one of the ingress traffic rule templates works for you, select it from the list. The protocol, source, source ports, traffic destination, and destination port fields will be filled in automatically.
7. If the templates do not work, specify your own rule parameters:
7.1. Select a protocol or click **All protocols**.
7.2. Specify the traffic source (Source):
* for traffic from an IP address or subnet—select **CIDR** and enter the IP address or subnet, or click **All sources**;
* for traffic from a security group — select **Security group** and choose the group. You can use security groups in the same pool. If you need to accept traffic from another pool, specify the source CIDR.
7.3. Enter the port to allow traffic on (Dst. port)—a single port or a range of ports, or click **All ports**.
7.4. Optional: enter a comment for the rule.
8. Click **Create**.
OpenStack CLI
1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
2. Create a rule in the group:
3. Optional: check the list of rules in the security group:
```bash
openstack security group rule list
```
Specify `` —the ID or name of the security group you added the rule to in step 2; you can check it using the `openstack security group list` command.
## Create an egress traffic rule \{#create-rule-egress}
Control panel
1. In the [Control panel](https://my.selectel.ru/vpc/default/security-groups), from the top menu, click **Products** and select **Cloud Servers**.
2. Go to the **Security Groups** section.
3. Open the security group page.
4. Open the **Egress** tab.
5. Click **Create rule**.
6. If one of the egress traffic rule templates works for you, select it from the list. The protocol, source, source ports, traffic destination, and destination port fields will be filled in automatically.
7. If the templates do not work, specify your own rule parameters:
7.1. Select a protocol or click **All protocols**.
7.2. Specify the traffic destination (Destination):
* for traffic from an IP address or subnet—select **CIDR** and enter the IP address or subnet, or click **All sources**;
* for traffic from a security group — select **Security group** and choose the group. You can use security groups in the same pool. If you need to send traffic to another pool, specify the source CIDR.
7.3. Enter the source port (Src. port)—a single port or a range of ports, or click **All ports**.
7.4. Optional: enter a comment for the rule.
8. Click **Create**.
OpenStack CLI
1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
2. Create a rule in the group:
3. Optional: check the list of rules in the security group:
```bash
openstack security group rule list
```
Specify `` —the ID or name of the security group you added the rule to in step 2; you can check it using the `openstack security group list` command.
## Bulk add rules from a file \{#batch-add-rules-via-file}
1. [Prepare a file with the rule descriptions](#prepare-file-with-rules-description).
2. [Upload the file to the Control panel](#upload-file-to-panel).
### 1. Prepare a file with the rule descriptions \{#prepare-file-with-rules-description}
1. In the [Control panel](https://my.selectel.ru/vpc/default/security-groups), from the top menu, click **Products** and select **Cloud Servers**.
2. Go to the **Security Groups** section.
3. Download the file to edit:
* to download a file with a description of the rules you previously created for another security group, in the menu of the required security group, select **Download JSON with rules**;
* to download a file with rule templates, in the menu of any security group, select **Add rules from JSON** and click the link in the text.
4. Open the downloaded file in any text editor.
5. Edit the file content—delete or add the required number of rule blocks, and specify the parameters for each rule:
* `direction` — traffic direction: `ingress` for inbound traffic, `egress` for outbound;
* `ethertype` — IP type: only `IPv4`;
* `port_range_max` — the last port in the allowed port range: a number from 1 to 65 535. If the rule protocol is `icmp`, specify the ICMP type instead of the port number. To allow all ports or ICMP types, specify `null`;
* `port_range_min` — the first port in the allowed port range: a number from 1 to 65 535. If the rule protocol is `icmp`, specify the ICMP type instead of the port number. To allow all ports or ICMP types, specify `null`;
* `protocol` — protocol name:
* `icmp` — ICMP;
* `tcp` — TCP;
* `udp` — UDP;
* `any` or `null` — any protocol;
* traffic source or destination — specify one of the parameters, for the other specify `null`:
* `remote_group_id` — security group ID, which can be viewed in the [Control panel](https://my.selectel.ru/vpc/default/security-groups): in the top menu, click **Products** → **Cloud Servers** → **Security Groups** → in the group card, click . You can specify only a group in the same pool; for traffic from another pool, use `remote_ip_prefix`. To allow traffic from all security groups, specify `null`;
* `remote_ip_prefix` — IP address or subnet in CIDR format. To allow traffic from all IP addresses, specify `null`.
If you specify `null` for both parameters, all traffic matching the remaining rule parameters will be allowed.
6. Save the modified file.
### 2. Upload the file to the Control panel \{#upload-file-to-panel}
1. In the [Control panel](https://my.selectel.ru/vpc/default/security-groups), in the top menu, click **Products** and select **Cloud Servers**.
2. Go to the **Security Groups** section.
3. In the menu of the security group, select **Add rules from JSON**.
4. Choose how to add the rules from the file:
* add new rules to the existing ones;
* or delete the old rules and add new ones.
5. Upload the file you [prepared earlier](#prepare-file-with-rules-description) — drag and drop it into the upload field or click the upload field and select the file.
6. Click **Add** or **Remove and add**.