---
title: "Get started with Security Group"
description: "Create a security group that lets SSH in from your IP only, attach it to a node in place of the default group, and check that it works."
content_type: "get-started"
product: "security-group"
platform: "MyAccount"
url: "/myaccount/security-group/get-started/"
---

# Get started with Security Group

Lock SSH on your node down to your own IP address. You need a MyAccount account and a Linux node. If
you do not have a node yet, [create one](/myaccount/node/how-to/create-a-node/) first.

Your node already has a security group: the default group, attached when the node launched.
The default group allows all traffic from anywhere, SSH included. Groups on a node add up, so you will
attach your own group first and then detach the default.

## Create a group that allows SSH from your IP

Open **Network > Security Group**, click **Create Security Group**, and give the group a name,
such as `ssh-from-office`. A group needs at least one inbound rule and one outbound rule:

1. Under **Inbound Rules**, set **Protocol** to **Custom TCP**, type `22` in **Port Range**, and
   set **Source IPv4/Network** to **My IP / Whitelist IP**. The field fills in your current
   public IP address.
2. Under **Outbound Rules**, set **Protocol** to **ALL** and **Source IPv4/Network** to **Any
   Network**, so the node can still reach the internet for updates and packages.

Click **Create Group**. The group appears in the security group list.

## Attach your group and detach the default

1. Open **Compute > Nodes**, select your node, and open its **Security Group** tab.
2. Click **Attach Security Group**, pick your new group, and click the check mark. The group
   joins the node's list, next to the default group.
3. Next to the default group, click **Detach**, then click **Confirm**.

Your group is now the only one on the node, so its rules decide what gets in.

## Check that it works

From your own computer, connect over SSH as usual; see
[Connect to a Linux node](/myaccount/node/how-to/connect-to-a-linux-node/). The connection
opens, because your IP address is allowed. From any other network, such as a phone hotspot,
the same command does not connect.

If your public IP address changes later, for example on a new network, edit the inbound rule
to the new address.

## What to do next with your security group

- [Add or edit rules](/myaccount/security-group/how-to/add-or-edit-rules/) to open a web port
  or allow traffic from a [VPC](/myaccount/vpc/).
- [Set a security group as default](/myaccount/security-group/how-to/set-a-security-group-as-default/)
  so new nodes start with your group instead.
- [Troubleshooting Security Group](/myaccount/security-group/troubleshooting/security-group/)
  if a port stays closed or a rule is rejected.