---
title: "Security Group"
description: "A security group is a virtual firewall you attach to a node to control which traffic can reach it and leave it, by protocol, port, and source."
content_type: "overview"
product: "security-group"
platform: "MyAccount"
url: "/myaccount/security-group/"
---

# Security Group

A security group is a virtual firewall. Its rules say which traffic can reach a resource and
which can leave it, by protocol, port, and source address. You write the rules once and attach
the group to a node, autoscale group, Kubernetes cluster, load balancer, or database. A change
to the rules then applies everywhere the group is attached.

Every node starts with one. Each account has a default security group per project and region,
and a new node gets it unless you pick another group while creating the node. The default that
E2E creates allows all traffic in and out, so a new node works straight away.
When you want tighter control, such as SSH only from your office, you attach a group of your
own.

Common uses are keeping SSH and RDP to trusted addresses, opening the web ports to everyone,
and limiting a database port to your [VPC](/myaccount/vpc/).

Rules only ever allow traffic, and the groups on a node add up: traffic gets through when any
one of them allows it. To narrow what reaches a node, attach your stricter group and then
detach the group that allowed more.

A security group is separate from the [Firewall](/myaccount/firewall/) product, which is a
FortiGate appliance.

## What you can do

Create and configure a group:

- [Create a security group](/myaccount/security-group/how-to/create-a-security-group/)
- [Add or edit rules](/myaccount/security-group/how-to/add-or-edit-rules/)

Attach and detach:

- [Attach a security group to a node](/myaccount/security-group/how-to/attach-a-security-group-to-a-node/)
- [Detach a security group from a node](/myaccount/security-group/how-to/detach-a-security-group-from-a-node/)
- [Allow all traffic on a node temporarily](/myaccount/security-group/how-to/allow-all-traffic-on-a-node/)

Manage the group:

- [Set a security group as default](/myaccount/security-group/how-to/set-a-security-group-as-default/)
- [Delete a security group](/myaccount/security-group/how-to/delete-a-security-group/)

## Where to start

[Get started with Security Group](/myaccount/security-group/get-started/) sets up a group that
lets SSH in from your own IP only and puts it on a node. If something does not behave
as you expect, [Troubleshooting Security Group](/myaccount/security-group/troubleshooting/security-group/)
lists the errors and their fixes.