Create a security group | Selectel Documentation

Create a group

When creating a group, you can add rules for incoming traffic to allow it immediately. Outbound traffic is allowed by default — two rules for outbound traffic are automatically added to the group, which cannot be changed or deleted during group creation. These rules are needed so that the server can request the necessary data for its configuration during creation.

After you create a group, you can delete any rules in it, including the default rules, and create new ones.

Through the control panel, you can create a group with stateful mode and TCP, UDP, ICMP, or Any (all protocols) rule protocols. Through the OpenStack CLI, you can create a group with stateful or stateless mode AND any rule protocol.

Control panel
OpenStack CLI

In the dashboard, on the top menu, click Products and select Cloud Servers.
Go to the Security Groups section.
Click Create a security group.
Select the pool where the group will be created. It can only be assigned to ports in the same pool.
Create rules for incoming traffic. To do this, in the Incoming traffic block:

5.1 If one of the rule templates for incoming traffic is suitable for you, click on the template name. The Protocol, Source, Source Port, Traffic Destination, and Destination Port fields will be filled in automatically. Go to step 6.

5.2 If the templates are not suitable, add your own rule for incoming traffic. Click Add Inbound Traffic Rule.

5.3. Select a protocol or click All Protocols.

5.4 Specify the traffic source (Source):
- for traffic from an IP address or subnet — select CIDR and enter the IP address or subnet, or click All Sources;
- for traffic from a security group — select Security Group and select the group. Security groups in the same pool are available. If you need to accept traffic from another pool, specify the source CIDR.
5.5. Enter the port on which traffic is allowed to be received (Dst. port) — a single port or a range of ports, or click All Ports.

5.6 Optional: enter a comment for the rule.

5.7 Click Add. Once the group is created, the rule cannot be changed, you can delete the rule and create a new one.

5.8 To add another rule, repeat steps 5.2 through 5.7.
Optional: In the Ports block, select the ports to which the security group will be assigned. Ports with port security enabled that are not connected to devices or connected to a cloud server are available . After the group is created, any active sessions that do not comply with the group rules will be terminated on the selected ports.
Enter a name for the group or leave the name created automatically.
Optional: enter a comment for the group.
Click Create Security Group. To restrict outgoing traffic, delete the default rules and create new ones.

Open the OpenStack CLI.
Create a security group:
```
openstack security group create \
    [--description "<description>"] \
    [--stateless] \
    <security_group_name>
```
Specify:
- optional: --description "<description>" — description of the security group. Parameter <description> — description text;
- optional: group mode — --stateful or --stateless. If you do not specify a mode, a stateful group will be created;
- <security_group_name> — name of the security group.
Create a rule in the group:
- Incoming traffic
- Outgoing traffic
openstack security group rule create \ --ingress \ [--remote-ip <remote_ip> | --remote-group <remote_group>] \ [--protocol <protocol>] \ [--dst-port <port_range>] \ <security_group>
Specify:
- optional: traffic source, you can specify one or both parameters. If you do not specify a source, the default subnet is 0.0.0.0.0/0:
  
  --remote-ip <remote_ip> — to receive traffic from an IP address. Parameter <remote_ip> — IP address or subnet in CIDR format;
  
  --remote-group <remote_group> — to accept traffic from another security group. The parameter <remote_group> — ID or group name, can be viewed with the command openstack security group list. To allow traffic within a group, specify its name. You can only specify a group in the same pool, for traffic from another pool use --remote-ip <remote_ip>;
- optional: --protocol <protocol> — protocol. The parameter <protocol> is the name of the protocol from the list below. If you do not specify the parameter, any protocols will be allowed:
  
  icmp — ICMP;
  
  tcp — TCP;
  
  udp — UDP;
  
  ah — AH;
  
  dccp — DCCP;
  
  egp — EGP;
  
  esp — ESP;
  
  gre — GRE;
  
  igmp — IGMP;
  
  ipv6-encap — IPv6-ENCAP;
  
  ipv6-frag — IPv6-Frag;
  
  ipv6-icmp — IPv6-ICMP;
  
  ipv6-nonxt — IPv6-NoNxt;
  
  ipv6-opts — IPv6-Opts;
  
  ipv6-route — IPv6-Route;
  
  ospf — OSPF;
  
  pgm — PGM;
  
  rsvp — RSVP;
  
  sctp — SCTP;
  
  udplite — UDP Lite;
  
  vrrp — VRRP;
  
  ipip — IP-in-IP;
  
  any — any protocol;
- optional: --dst-port <port_range> — server ports on which it is allowed to receive traffic. Parameter <port_range> — port number or port range, for example 137:139. Specify if <protocol> is tcp, udp, or any.
  
  Traffic to any TCP/UDP port blocked in Selectel by default will be denied even if you specify that port in the rule;
- <security_group> — The ID or name of the security group can be viewed with the command openstack security group list.
openstack security group rule create \ --egress \ [--remote-ip <remote_ip> | --remote-group <remote_group>] \ [--dst-port <port_range>] \ [--protocol <protocol>] \ <security_group>
Specify:
- optional: traffic assignment, you can specify one or both parameters. If you do not specify a destination, the default subnet is 0.0.0.0.0/0:
  
  --remote-ip <remote_ip> — To send traffic to an IP address. Parameter <remote_ip> — IP address or subnet in CIDR format;
  
  --remote-group <remote_group> — to send traffic to another security group. The parameter <remote_group> — ID or group name, can be viewed with the command openstack security group list. To allow traffic within a group, specify its name. You can only specify a group in the same pool, for traffic from another pool use --remote-ip <remote_ip>;
- optional: --protocol <protocol> — protocol. The parameter <protocol> is the name of the protocol from the list below. If you do not specify the parameter, any protocols will be allowed:
  
  icmp — ICMP;
  
  tcp — TCP;
  
  udp — UDP;
  
  ah — AH;
  
  dccp — DCCP;
  
  egp — EGP;
  
  esp — ESP;
  
  gre — GRE;
  
  igmp — IGMP;
  
  ipv6-encap — IPv6-ENCAP;
  
  ipv6-frag — IPv6-Frag;
  
  ipv6-icmp — IPv6-ICMP;
  
  ipv6-nonxt — IPv6-NoNxt;
  
  ipv6-opts — IPv6-Opts;
  
  ipv6-route — IPv6-Route;
  
  ospf — OSPF;
  
  pgm — PGM;
  
  rsvp — RSVP;
  
  sctp — SCTP;
  
  udplite — UDP Lite;
  
  vrrp — VRRP;
  
  ipip — IP-in-IP;
  
  any — any protocol;
- optional: --dst-port <port_range> — server ports from which it is allowed to send traffic. Parameter <port_range> — port number or port range, for example 137:139. Specify if <protocol> is tcp, udp, or any.
  
  Traffic to any TCP/UDP port blocked in Selectel by default will be denied even if you specify that port in the rule;
- <security_group> — The ID or name of the security group can be viewed with the command openstack security group list.
Optional: create another rule in the group, repeat step 3 to do so.
Optional: check the list of rules in the security group:
```
openstack security group rule list <security_group>
```
Specify <security_group> — The ID or name of the security group you created in step 2 can be viewed using the openstack security group list command.