Add or edit rules

Rules are where a security group does its work. Inbound rules decide what can reach the resource, and outbound rules decide what it can send out. Every rule allows traffic, and anything no rule allows is blocked. A change you save applies to every resource the group is attached to.

Before you begin

• A security group. See Create a security group.

Choose a protocol

Protocol	Use it for
ALL	Every protocol on every port.
All TCP	Every TCP port.
All UDP	Every UDP port.
ICMP	Network checks such as ping.
Custom TCP	Chosen TCP ports, such as 22 for SSH or 443 for HTTPS.
Custom UDP	Chosen UDP ports, such as 53 for DNS.

Start with Custom TCP or Custom UDP and open only the ports your service uses. For the other four, the port range is set to All for you.

Choose the ports

In Port Range, enter a single port, a comma-separated list, or a range, such as 80,100-200, with up to 50 entries in one rule. As you type, a list of well-known ports (SSH 22, HTTP 80, HTTPS 443, and more) appears to pick from. Each port belongs to one rule in a group, so give each rule its own ports.

Choose the source

Source IPv4/Network is the other end of the traffic: where an inbound rule lets traffic come from, or where an outbound rule lets it go.

Source	Traffic it allows
Any Network	Any IP address.
VPC Network	Addresses in the VPC you pick from the list.
Custom (Manual)	One IPv4 address, or a block of addresses such as 203.0.113.0/24.
My IP / Whitelist IP	Your current public IP address, filled in for you. Inbound only.

My IP / Whitelist IP is the quickest way to keep SSH or RDP to yourself, and you can edit the address it fills in. A VPC shows in the list once it has finished being created. For a block in Custom (Manual), start from the first address of the block: 203.0.113.0/24 works, 203.0.113.1/24 does not. To allow every address, choose Any Network rather than a /0 block.

If the operating system runs its own firewall

A firewall inside the node, such as ufw or firewalld on Linux, or Windows Firewall, filters traffic too, and a port must be open there as well. E2E recommends managing access with security groups alone. When a service still cannot be reached, allow all traffic on the node temporarily to find out which side is blocking it.

Add a rule

1. Open Network > Security Group and select the group.
2. Open the Inbound Rules or Outbound Rules tab.
3. Click + Add Inbound Rule or + Add Outbound Rule, and set the protocol, ports, and source.
4. Click Update Group.

Change or remove a rule

1. Open Network > Security Group and select the group.
2. Open the Inbound Rules or Outbound Rules tab.
3. Change the rule’s Protocol, Port Range, or Source IPv4/Network, or click its delete icon to remove it. A group keeps at least one rule in each direction.
4. Click Update Group.

If the group is not on a node yet, attach it. Each error a rule can get is explained in Troubleshooting Security Group.