---
title: "Manage a load balancer's network and security groups"
description: "Reserve an E2E load balancer's public IP, attach VPCs, and set the security group rules on the load balancer and its servers."
content_type: "how-to"
product: "load-balancer"
platform: "MyAccount"
url: "/myaccount/load-balancer/how-to/manage-network-and-security-groups/"
topic: ["network-and-security"]
relationships: {"requires":["/myaccount/load-balancer/how-to/create-an-application-load-balancer/"]}
---

# Manage a load balancer's network and security groups

A load balancer's **Network** tab holds its public IP and its VPCs, and its
**Security Group** tab holds its security groups. Your users reach your servers only when two sets
of rules agree: the load balancer's security group lets your users in, and each server's security
group lets the load balancer in.

## Before you begin

- The load balancer reads **Running** or **Backend Connection Failure**, the statuses in which the
  **Network** and **Security Group** tabs are available.
- Any VPC you plan to attach is in the load balancer's region and has finished **Creating**. See
  [Create a VPC](/myaccount/vpc/how-to/create-a-vpc/).
- Any security group you plan to attach has the rules you need. See
  [Create a security group](/myaccount/security-group/how-to/create-a-security-group/).
- Your role in the project has the update permission for **Load Balancers**.

## See the network

In MyAccount, under **Compute**, click **Load Balancers**, click the load balancer, and open its
**Network** tab. It shows:

- **Public IP**, marked **(Reserved)** once you reserve it.
- **Associated VPC**, with each VPC's **VPC Name**, **Subnet Name**, **IP**, and **Network Mask**,
  or **No VPC attached**.

The list's **Private IP** column shows the first VPC address, or the load balancer's private IP when
no VPC is attached.

## Reserve the public IP

Reserve the public IP of an external load balancer to keep the address when you delete the load
balancer, for your next one or for a node.

1. On the **Network** tab, next to **Public IP**, click **Click here**. Or, on the **Info** tab,
   click **Reserve Public IP**.
2. In **Reserve IP Address**, click **Reserve IP**. The IP stays yours after the load balancer is
   deleted, and each reserved IP has a monthly charge.

**Public IP** then reads **(Reserved)**. A reserved IP is billed until you release it; see
[Reserved IP](/myaccount/reserved-ip/) and
[E2E's pricing page](https://www.e2enetworks.com/pricing).

A reserved IP you already own becomes a load balancer's public IP only when you create the load
balancer, under **IPV4** on **Peak Performance Features**. A load balancer has one public IP and
takes no add-on IP. A Floating IP attaches only to nodes.

## Attach a VPC

Attach a VPC to reach servers at their addresses in that VPC, or to make an internal load balancer
reachable from another VPC. You can attach up to three VPCs. The load balancer talks over its VPC
address only with resources in the same VPC.

Attaching the first VPC removes the load balancer's private IP. From then on, it reaches your
servers from its VPC address, so your servers need an address in that VPC.

1. On the **Network** tab, under **Associated VPC**, click **Click here** when no VPC is attached,
   or **+** to attach another.
2. In **Attach VPC**, under **Select VPC**, pick one of your VPCs in the region that has finished
   **Creating** and is not yet attached to this load balancer.
3. (Optional) For a custom VPC, pick a subnet under **Select Subnet (Optional)**. The load balancer
   takes its VPC address from that subnet. Each subnet shows how many of its addresses are in use;
   pick one with addresses free.
4. Confirm, and the VPC attaches with **VPC attached successfully**.

The VPC is attached once the load balancer reads **Running** again.

After you attach the first VPC:

1. On **Backend Mapping**, change each server's **Server IP** to its address in the VPC. See
   [Add or change servers](/myaccount/load-balancer/how-to/manage-backend-groups/#add-or-change-servers).
2. In each server's security group, allow the server port from the load balancer's VPC address. See
   [Allow traffic from the load balancer to your servers](#allow-traffic-from-the-load-balancer-to-your-servers).

## Detach a VPC

1. On the **Network** tab, in the VPC's row, click **Detach VPC**, and confirm.

**VPC detached successfully** shows, and the detach takes effect once the load balancer reads
**Running** again. Detaching the last VPC gives the load balancer a private IP again. Then:

1. On **Backend Mapping**, change each **Server IP** back to the node's private IP.
2. In each server's security group, allow the server port from the load balancer's private IP,
   shown in the list's **Private IP** column.

An internal load balancer must have at least one VPC. To move it to another VPC, attach the new one
first, then detach the old one.

## Allow traffic to the load balancer

The load balancer's security group must allow its listening ports from your users: 80 for **HTTP**,
443 for **HTTPS**, both for **Both (HTTP and HTTPS)**, and each **LB Listening Port** on a Network
Load Balancer. Allow only these ports, from the addresses that need them. Your project's default
security group allows all traffic.

The load balancer accepts connections only on ports 80 and 443, and on each **LB Listening Port** of
a Network Load Balancer. A security group rule for any other port leaves that port closed.

To test the load balancer, connect to a listening port; it does not answer ping, whatever its
security group allows. On an Application Load Balancer that serves **HTTP** or **Both (HTTP and
HTTPS)**:

```bash
curl -I http://<load-balancer-ip>/
```

On one that serves **HTTPS** only, use your domain, since the certificate covers the domain:

```bash
curl -I https://<your-domain>/
```

On a Network Load Balancer, connect to a listening port:

```bash
nc -zv -w 5 <load-balancer-ip> <listening-port>
```

`<load-balancer-ip>` is the load balancer's **Public IP**, `<your-domain>` a domain pointed at it,
and `<listening-port>` a group's **LB Listening Port**. For an internal load balancer, run the
command from a machine in the same VPC, with the VPC address shown in the list's **Private IP**
column.

## Allow traffic from the load balancer to your servers

Each server's security group must allow the server port from the load balancer:

- Without a VPC, from the load balancer's private IP, in the list's **Private IP** column.
- With a VPC, from the load balancer's address in that VPC, on the **Network** tab.

See [Add or edit rules](/myaccount/security-group/how-to/add-or-edit-rules/). A firewall inside the
server's operating system needs the same rule.

## Change the load balancer's security groups

The **Security Group** tab lists each attached group with its description and its
**Inbound Rules** and **Outbound Rules**. Each rule shows its **Protocol**, **Port Range**,
**Network Type**, **First IP Address**, and **Size**. The security groups work as they do on a node:

- To add groups, click **Attach Security Group**, find a group by name, pick one or more, and
  confirm; the groups attach with **Security Group Attached Successfully**. When no group is left to
  attach, the tab says **No more Security Groups are available.**
- To rule out the security group while you test, click **Allow All Traffic**. It attaches one more
  group that allows all inbound and outbound traffic, and that group stays until you detach it.
  Detach it when the test is done. The load balancer still accepts connections only on its
  listening ports.
- To remove one, click **Detach** on it, and click **Confirm** in **Detach Security Group**.
  **Security Groups Detached Successfully** confirms it. The load balancer must have at least one
  security group. To replace the last one, attach the new group first, then detach the old one.

For the rules themselves, see [Security Group](/myaccount/security-group/).

## Check the network

When the load balancer reads **Running** again, the **Network** tab shows the reserved IP and the
attached VPCs with their addresses, and the **Security Group** tab lists the groups you attached.
Open the load balancer's address from a client, and your application opens.

If the load balancer reads **Backend Connection Failure** after a VPC or security group change, see
[The load balancer shows Backend Connection Failure](/myaccount/load-balancer/troubleshooting/load-balancer/#the-load-balancer-shows-backend-connection-failure).