---
title: "Add or edit rules"
description: "Add, change, or remove the inbound and outbound rules of a security group, choosing a protocol, port range, and source for each."
content_type: "how-to"
product: "security-group"
platform: "MyAccount"
url: "/myaccount/security-group/how-to/add-or-edit-rules/"
topic: ["create"]
relationships: {"requires":["/myaccount/security-group/how-to/create-a-security-group/"]}
---

# Add or edit rules

Rules are where a security group does its work. Inbound rules decide what can reach the
resource, and outbound rules decide what it can send out. Every rule allows traffic, and
anything no rule allows is blocked. A change you save applies to every resource the group is
attached to.

## Before you begin

- A security group. See [Create a security group](/myaccount/security-group/how-to/create-a-security-group/).

## Choose a protocol

| Protocol       | Use it for                                             |
| -------------- | ------------------------------------------------------ |
| **ALL**        | Every protocol on every port.                          |
| **All TCP**    | Every TCP port.                                        |
| **All UDP**    | Every UDP port.                                        |
| **ICMP**       | Network checks such as `ping`.                         |
| **Custom TCP** | Chosen TCP ports, such as 22 for SSH or 443 for HTTPS. |
| **Custom UDP** | Chosen UDP ports, such as 53 for DNS.                  |

Start with **Custom TCP** or **Custom UDP** and open only the ports your service uses. For the
other four, the port range is set to **All** for you.

## Choose the ports

In **Port Range**, enter a single port, a comma-separated list, or a range, such as `80,100-200`,
with up to 50 entries in one rule. As you type, a list of well-known ports (SSH 22, HTTP 80, HTTPS
443, and more) appears to pick from. Each port belongs to one rule in a group, so give each rule its
own ports.

## Choose the source

**Source IPv4/Network** is the other end of the traffic: where an inbound rule lets traffic
come from, or where an outbound rule lets it go.

| Source                   | Traffic it allows                                                   |
| ------------------------ | ------------------------------------------------------------------- |
| **Any Network**          | Any IP address.                                                     |
| **VPC Network**          | Addresses in the VPC you pick from the list.                        |
| **Custom (Manual)**      | One IPv4 address, or a block of addresses such as `203.0.113.0/24`. |
| **My IP / Whitelist IP** | Your current public IP address, filled in for you. Inbound only.    |

**My IP / Whitelist IP** is the quickest way to keep SSH or RDP to yourself, and you can edit
the address it fills in. A VPC shows in the list once it has finished being created. For a
block in **Custom (Manual)**, start from the first address of the block: `203.0.113.0/24` works,
`203.0.113.1/24` does not. To allow every address, choose **Any Network** rather than a `/0`
block.

## If the operating system runs its own firewall

A firewall inside the node, such as ufw or firewalld on Linux, or Windows Firewall, filters
traffic too, and a port must be open there as well. E2E recommends managing access with
security groups alone. When a service still cannot be reached,
[allow all traffic on the node temporarily](/myaccount/security-group/how-to/allow-all-traffic-on-a-node/)
to find out which side is blocking it.

## Add a rule

1. Open **Network > Security Group** and select the group.
2. Open the **Inbound Rules** or **Outbound Rules** tab.
3. Click **+ Add Inbound Rule** or **+ Add Outbound Rule**, and set the protocol, ports, and
   source.
4. Click **Update Group**.

## Change or remove a rule

1. Open **Network > Security Group** and select the group.
2. Open the **Inbound Rules** or **Outbound Rules** tab.
3. Change the rule's **Protocol**, **Port Range**, or **Source IPv4/Network**, or click its
   delete icon to remove it. A group keeps at least one rule in each direction.
4. Click **Update Group**.

If the group is not on a node yet, [attach it](/myaccount/security-group/how-to/attach-a-security-group-to-a-node/). Each error a rule can get is explained in [Troubleshooting Security Group](/myaccount/security-group/troubleshooting/security-group/).