Create a group
When creating a group, you can add rules for incoming traffic to allow it immediately. Outbound traffic is allowed by default — two rules for outbound traffic are automatically added to the group, which cannot be changed or deleted during group creation.
Once you have created a group, you can remove any rules in it, including the default rules, and create new.
You can create a group with stateful mode and protocols via the control panel rules TCP, UDP, ICMP, or Any (all protocols). Through the OpenStack CLI, you can create a group with stateful or stateless mode AND any rule protocol.
Control panel
OpenStack CLI
-
В control panels from the top menu, press Products and select Cloud servers.
-
Go to the section Security groups.
-
Click Create a security team.
-
Select pool A group will be created in the pool. It can only be assigned to ports in the same pool.
-
Create rules for incoming traffic. To do this, in the block Incoming traffic:
5.1 If one of the rule templates for incoming traffic is suitable for you, click on the template name. The Protocol, Source, Source Port, Traffic Destination, and Destination Port fields will be filled in automatically. Go to step 6.
5.2 If the templates do not fit, add your own rule for incoming traffic. Click Add an incoming traffic rule.
5.3. Select a protocol or press All protocols.
5.4 Specify the traffic source (Source):
- for traffic from an IP address or subnet — select CIDR and enter an IP address or subnet, or tap All sources;
- for traffic from the security group — select Security Group and select a group. Security groups in the same pool are available. If you need to accept traffic from another pool, specify the source CIDR.
5.5. Enter the port on which traffic is allowed to be received (Dst. port) — a single port or a range of ports, or press All ports.
5.6 Optional: enter a comment for the rule.
5.7. Press Add. Once a group has been created, a rule cannot be changed, but can remove the rule и create a new.
5.8 To add another rule, repeat steps 5.2 through 5.7.
-
Optional: in the unit Ports check the ports to which the security group will be assigned. Ports with the following enabled are available port security When you create a group on the selected ports, any active sessions that do not comply with the group rules will be terminated. After the group is created, any active sessions that do not comply with the group rules will be terminated on the selected ports.
-
Enter a name for the group or leave the name created automatically.
-
Optional: enter a comment for the group.
-
Click Create a security team. To limit outgoing traffic, remove the rules default and create new ones.
-
Create a security group:
openstack security group create \
[--description "<description>"] \
[--stateless] \
<security_group_name>Specify:
- optional:
--description "<description>"
— description of the security group. Parameter<description>
- description text; - optional: group mode —
--stateful
or--stateless
. If you do not specify a mode, a stateful group will be created; <security_group_name>
- the name of the security team.
- optional:
-
Create a rule in the group:
Incoming traffic
Outgoing traffic
openstack security group rule create \
--ingress \
[--remote-ip <remote_ip> | --remote-group <remote_group>] \
[--protocol <protocol>] \
[--dst-port <port_range>] \
<security_group>Specify:
-
optional: traffic source, you can specify one or both parameters. If you do not specify a source, the subnet will be set by default
0.0.0.0/0
:--remote-ip <remote_ip>
— to receive traffic from an IP address. Parameter<remote_ip>
— IP address or subnet in CIDR format;--remote-group <remote_group>
— to receive traffic from another security group. Parameter<remote_group>
— ID or group name, can be viewed with the commandopenstack security group list
. To allow traffic within a group, specify the group name. You can only specify a group in the same pool, for traffic from another pool use--remote-ip <remote_ip>
;
-
optional:
--protocol <protocol>
— Protocol. Parameter<protocol>
— protocol name from the list below. If you do not specify a parameter, any protocols will be allowed:icmp
— ICMP;tcp
— TCP;udp
— UDP;ah
— AH;dccp
— DCCP;egp
— EGP;esp
— ESP;gre
— GRE;igmp
— IGMP;ipv6-encap
— IPv6-ENCAP;ipv6-frag
— IPv6-Frag;ipv6-icmp
— IPv6-ICMP;ipv6-nonxt
— IPv6-NoNxt;ipv6-opts
— IPv6-Opts;ipv6-route
— IPv6-Route;ospf
— OSPF;pgm
— PGM;rsvp
— RSVP;sctp
— SCTP;udplite
— UDP Lite;vrrp
— VRRP;ipip
— IP-in-IP;any
— any protocol;
-
optional:
--dst-port <port_range>
— server ports on which it is allowed to receive traffic. Parameter<port_range>
— port number or port range, e.g.137:139
. Indicate if<protocol>
—tcp
,udp
orany
.Traffic to any TCP/UDP port blocked in Selectel by default, will be denied even if you specify that port in the rule;
-
<security_group>
— ID or security group name, can be viewed using the commandopenstack security group list
.
openstack security group rule create \
--egress \
[--remote-ip <remote_ip> | --remote-group <remote_group>] \
[--dst-port <port_range>] \
[--protocol <protocol>] \
<security_group>Specify:
-
optional: traffic assignment, you can specify one or both parameters. If you do not specify a destination, the default subnet will be set to the subnet
0.0.0.0/0
:--remote-ip <remote_ip>
— to send traffic to an IP address. Parameter<remote_ip>
— IP address or subnet in CIDR format;--remote-group <remote_group>
— to send traffic to another security group. Parameter<remote_group>
— ID or group name, can be viewed with the commandopenstack security group list
. To allow traffic within a group, specify the group name. You can only specify a group in the same pool, for traffic from another pool use--remote-ip <remote_ip>
;
-
optional:
--protocol <protocol>
— Protocol. Parameter<protocol>
— protocol name from the list below. If you do not specify a parameter, any protocols will be allowed:icmp
— ICMP;tcp
— TCP;udp
— UDP;ah
— AH;dccp
— DCCP;egp
— EGP;esp
— ESP;gre
— GRE;igmp
— IGMP;ipv6-encap
— IPv6-ENCAP;ipv6-frag
— IPv6-Frag;ipv6-icmp
— IPv6-ICMP;ipv6-nonxt
— IPv6-NoNxt;ipv6-opts
— IPv6-Opts;ipv6-route
— IPv6-Route;ospf
— OSPF;pgm
— PGM;rsvp
— RSVP;sctp
— SCTP;udplite
— UDP Lite;vrrp
— VRRP;ipip
— IP-in-IP;any
— any protocol;
-
optional:
--dst-port <port_range>
— server ports from which traffic is allowed to be sent. Parameter<port_range>
— port number or port range, e.g.137:139
. Indicate if<protocol>
—tcp
,udp
orany
.Traffic to any TCP/UDP port blocked in Selectel by default, will be denied even if you specify that port in the rule;
-
<security_group>
— ID or security group name, can be viewed using the commandopenstack security group list
.
-
Optional: create another rule in the group, repeat step 3 to do so.
-
Optional: check the list of rules in the security group:
openstack security group rule list <security_group>
Specify
<security_group>
— The ID or name of the security group you created in step 2 can be viewed using the commandopenstack security group list
.