Security group rules
Learn how security group rules work, from directions, protocols, and port ranges to sources and destinations, IPv4 and IPv6, presets, and default rules.
A security group rule allows one kind of traffic in one direction. Traffic that matches a rule of any group on a port is allowed. All other traffic to and from the port is dropped.
Every rule has these parts:
| Part | Values |
|---|---|
| Direction | Ingress for traffic into the port, Egress for traffic out of it. |
| Ether type | IPv4 or IPv6. |
| Protocol | TCP, UDP, ICMP, or Any. |
| Ports | For TCP and UDP: one port, a range, or all ports. |
| Remote end | An address block, or a security group. It's the source of an ingress rule and the destination of an egress rule. |
| Description | Optional text. |
On a group's page, the rule tables show these parts in the columns Ether, Port range, Protocol, Source / dest, and Description. The Action of every rule is Allow.
Direction
An ingress rule lets traffic in, from the sources that it names. An egress rule lets traffic out, to the destinations that it names. For example, an ingress rule for TCP port 22 from 203.0.113.10/32 lets one office computer open SSH connections to the instance.
Stateful filtering
Security groups are stateful. When a rule allows a connection, the replies of that connection are allowed automatically, whatever the rules for the other direction say. You write rules for the direction in which connections start:
- An ingress rule for TCP port 443 from
0.0.0.0/0lets clients connect to a web server. The server's answers need no egress rule. - An egress rule to
0.0.0.0/0lets the instance download updates. The downloads need no ingress rule.
Allow-only rules
Rules only allow traffic. There are no deny rules: what no rule allows is dropped. A group's Overview tab shows this as Default action: Deny (implicit).
When a port has several groups, their rules add up. To narrow what a port accepts, remove rules or detach groups; adding a group can only allow more.
Protocols and ports
| Protocol | Ports |
|---|---|
| TCP and UDP | One port, such as 22; a range, such as 8000–8080; or All ports. Ports range from 1 to 65535, and the first port of a range can't be greater than the last. |
| ICMP | No ports. The rule matches ICMP traffic, such as ping. |
| Any | No ports. The rule matches every protocol and port. |
Source and destination
The remote end of a rule is one of these:
- An address block. An IPv4 or IPv6 address or block, such as
203.0.113.0/24.0.0.0.0/0matches every IPv4 address, and::/0every IPv6 address. My IP fills in your current public address, as a /32 block for IPv4 or a /128 block for IPv6. - A security group. The rule matches the traffic of every port that uses the selected group. Select the same group to allow traffic between its own members. You can choose a group as the remote end when you add or edit rules on a group's page; the create form takes address blocks only.
For example, a database group db-sg with an ingress rule for TCP port 5432 from the group app-sg accepts database connections from the application servers in app-sg, whatever their addresses are.
A rule names exactly one remote end. A rule that duplicates an existing rule of the group isn't added a second time.
IPv4 and IPv6
A rule's ether type must match the family of its address block: IPv4 for an IPv4 block, and IPv6 for an IPv6 block. When you add rules on a group's page, you choose the ether type in each row. When you create a group, each rule's ether type follows its source, so a source such as ::/0 makes an IPv6 rule.
To allow a service over both families, add one rule for each, for example HTTPS from 0.0.0.0/0 and HTTPS from ::/0.
Default rules
Every new security group gets two egress rules that allow all outbound traffic: one for IPv4 to 0.0.0.0/0 and one for IPv6 to ::/0. You can edit or delete them like any other rule. Without an egress rule that allows it, outbound traffic is dropped.
A new group has only the ingress rules that you add to it.
The default security group
Each project has a security group named default, which the cloud creates. It appears in the list of security groups, and you can open it to see and change its rules. It's used when you create an instance or a port without choosing a group, and it can't be deleted.
Presets
The rule editor has presets for common services. Each one adds an editable row with the protocol and the port filled in. The source stays empty: you enter it before you save.
| Preset | Protocol | Port |
|---|---|---|
| SSH | TCP | 22 |
| HTTP | TCP | 80 |
| HTTPS | TCP | 443 |
| MySQL | TCP | 3306 |
| PostgreSQL | TCP | 5432 |
| RDP | TCP | 3389 |
| DNS | UDP | 53 |
| Ping | ICMP | — |
| All traffic | Any | All ports |
The creation wizard for virtual machines has its own quick rules, which create a security group for the new instance. See Networking in the wizard.
Sensitive ports
The rule editor warns you when an ingress rule opens one of these TCP ports to the entire internet, that is, to 0.0.0.0/0 or ::/0:
| Service | Port |
|---|---|
| SSH | 22 |
| Telnet | 23 |
| RDP | 3389 |
| VNC | 5900 |
| MySQL | 3306 |
| PostgreSQL | 5432 |
| MSSQL | 1433 |
| MongoDB | 27017 |
| Redis | 6379 |
A rule for Any or for all ports covers every one of them. The warning doesn't stop you from saving the rule. To limit access to yourself, use My IP as the source.