Create and edit security groups and rules
Create a security group with its first rules, add, edit, and remove rules, and rename, duplicate, or delete a group in the console.
Create security groups, keep their rules up to date, and remove the groups that you no longer need. For how rules work, see Security group rules.
Before you begin
- You need the Owner or Contributor role on the subscription or on the project, or a custom role with Manage access to Networking.
- The subscription's quota and the project's allocation need room for the new security group and its rules. See Quotas.
Create a security group
In the console, go to NetworkingSecurity groups.
Select Create security group.
In Name, enter a name such as web-sg, and optionally a Description.
Under Initial rules, select a preset under Common services, or select Add rule. Each adds a row.
In each row, choose the direction, the protocol, and the ports, and enter the source block, or select My IP. To remove a row, select its remove button.
Select Create security group. The console waits until the group exists and returns to the list.
The group also gets the two default egress rules, which allow all outbound traffic. Rules that you add in this form get the description custom rule, and their source is an address block. To add rules with your own description or with a security group as the source, add them on the group's page afterward.
Add rules to a group
In the console, go to NetworkingSecurity groups, and open the group.
Select Add rule. The dialog Add security group rules opens with one row. If you open it from the Egress rules tab, the row is an egress rule.
In each row, choose the direction, the ether type, the protocol, and the ports. Choose CIDR and enter an address block, or choose Security group and select a group. Optionally, enter a description.
To add more rules in the same go, select a preset or Add rule.
Select the button that adds the rules, for example Add 2 rules.
The console adds the rules one after the other. A rule without a description gets one made of its protocol and ports, such as TCP 22. If the cloud refuses some rules, the rules that were added stay, and the dialog keeps only the refused rows, each with its reason, for you to fix and add again.
Edit a rule
On the group's Ingress rules or Egress rules tab, point to the rule, and select the pencil icon. The dialog Edit rule opens.
Change the parts of the rule.
Select Save rule. The console shows Rule updated.
The cloud doesn't change rules in place, so saving replaces the rule:
- If you change the ports, the protocol, the direction, or the source, the edited rule is added first, and the old rule is removed only then. Traffic that both rules allow keeps flowing during the edit. Traffic that only the old rule allowed stops when the old rule is removed.
- If you change only the description, the rule is recreated. Traffic that it allows can stop for a moment.
If the edit can't be saved, the old rule stays as it was, and the dialog shows the reason.
Remove rules
To remove one rule:
On the group's Ingress rules or Egress rules tab, point to the rule, and select the trash icon.
Select Remove rule.
To remove several rules of one direction:
On the Ingress rules or Egress rules tab, select the check boxes of the rules.
Select the delete button above the table, for example Delete 2 rules.
Select Remove rules.
The confirmation warns you: Traffic matching this rule will no longer be allowed. This cannot be undone.
Rename a group
On the group's page, select Edit.
Change the name.
Select Save changes.
You can't change the description in the console.
Duplicate a group
In the list of security groups, open the actions of the group's row, and select Duplicate. The console creates a group named after the original with -copy at the end, with the same description, and adds the original's rules to it.
- The copy gets its own two default egress rules. The original's default egress rules aren't copied, and the copy has them even if you removed them from the original.
- A rule whose source is a security group keeps pointing at the same group, including a rule that points at the original group itself.
- If a group with the copy's name already exists, the duplicate fails.
Delete a group
You can't delete:
- the project's
defaultgroup. Its Delete button is disabled with the hint The default security group can't be deleted. - a group that a port uses. The group's Associated resources tab lists the instances and ports that use it. Detach the group from them first. See Detach a security group from an instance, and for a port, Edit a port.
On the group's page, select Delete.
Select Delete group.
To delete several groups, select their check boxes in the list, select Delete, and confirm. If the selection includes default, the console skips it.
Troubleshooting
| Message | Cause | Resolution |
|---|---|---|
| One or more rules have an invalid port. Use 1–65535, and in a range the first port must not exceed the second. | A row has an invalid port, or a row has no valid source. | Enter ports from 1 to 65535, with the smaller port first in a range, and a source in every row. |
| Enter a valid IP address or CIDR block, e.g. 10.0.0.0/24. | The source isn't an address or a block. | Enter an address or a block, such as 203.0.113.0/24. |
| A message that a security group with this name already exists | The name is taken in the project. | Enter another name. |
| A message that the security group still has attached ports | A port uses the group. | Detach the group from the instances and ports that its Associated resources tab lists, and delete again. |
| 2 rules added, 1 failed — see the reasons below | The cloud refused some of the new rules. | Read the reason on each remaining row, fix it, and add the rows again. |