View the effective rules of a virtual machine
See every ingress rule that applies to an instance across its security groups, and attach or detach security groups on the instance's Networking tab.
The traffic of an instance is filtered by the rules of all the security groups attached to it. The instance's Networking tab lists these groups and every ingress rule that applies, in one table. There you also attach and detach groups.
Before you begin
- To view the rules, any role with Read access to Compute / Instances and to Networking is enough.
- To attach or detach security groups, you need the Owner or Contributor role on the subscription or on the project, or a custom role with Manage access to Compute / Instances.
View the effective rules
In the console, go to ComputeInstances, and open the instance.
Select the Networking tab.
In the Security groups panel, check which groups are attached. Each name links to the group's page.
Under Effective ingress security rules, read the rules.
The table lists the ingress rules of all the attached groups together, with the columns Group, Protocol, Port, Ether, Source, and Description. Incoming traffic is allowed when any of these rules allows it. A port of Any means all ports. The Ingress rules tile above shows how many rules there are.
The tab doesn't list egress rules. To check outbound traffic, look at the Outbound security rules step of the internet access check on the same tab, or open a group's Egress rules tab. See Check a virtual machine's internet access.
Attach a security group to an instance
On the instance's Networking tab, open the Select a security group… list above the security groups. It lists the groups that aren't attached yet.
Select the group, and select Attach.
When the group is attached, its ingress rules appear in the effective rules table.
Detach a security group from an instance
On the instance's Networking tab, select Detach on the group's row.
Confirm with Detach. The confirmation warns you: This group’s rules stop applying to the server, and the traffic they allowed is no longer let through.
See where a group is used
On a group's page, the Associated resources tab lists the instances and ports that use the group, with their type, network, private IP address, MAC address, and status. Each instance links to its page. The list of security groups shows the same count under Attached.