---
title: "Security groups and rules"
description: "How TIR security groups work as firewalls for your resources, what a rule holds, what the default group allows, and good practice."
content_type: "concept"
product: "tir-security-group"
platform: "TIR"
url: "/tir/tir-security-group/concepts/security-groups/"
---

# Security groups and rules

A security group is a virtual firewall for your TIR resources. Its rules say which inbound and
outbound traffic is allowed, so you control network access to your instances, VMs, inference
services, and Slurm clusters. A security group belongs to one project and one region.

## What a rule holds

Each group has inbound rules, for traffic coming to your resources, and outbound rules, for
traffic leaving them. A rule has a **Type**, a **Protocol**, **Ports**, a **Source** (inbound) or
**Destination** (outbound), and an optional **Description**.

- Inbound **Type** is **Custom TCP** or **SSH**. Outbound is **All Traffic**, **Custom TCP**, or
  **SSH**.
- Ports are 22, 80, 443, and 1024 to 65535. **SSH** is port 22.
- **Source** or **Destination** is **Any Network** or **Manual Network**, which takes one IPv4
  address. An inbound rule can also use **MyAccount VPC Network**, which outbound rules do not offer.

A group must keep at least one inbound and one outbound rule. When you change a group's rules, the
resources that have it attached pick up the change in the background. The steps are in
[Manage security group rules](/tir/tir-security-group/how-to/manage-security-group-rules/).

## The default group

Every project has a group named **Default-SSH-Security-Group** in each region. It has an inbound
rule allowing SSH (port 22) from any network and an outbound rule allowing all traffic. You can use
it at once when you create an instance, or create more groups for tighter access. The default group
is marked **SSH Default** and stays as it is: you cannot edit it, change its rules, or delete it.
To limit SSH to your own address, create a group with an inbound **SSH** rule from a
**Manual Network** address and attach it instead.

## The group details

Select a group in the **Security Groups** list to see four tabs.

| Tab                     | Shows                                                                                                                  |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| **Overview**            | The name, the description, the type (**SSH Default Security Group** or **Custom Security Group**), and who created it. |
| **Inbound Rules**       | Each inbound rule with its type, protocol, ports, source, and description.                                             |
| **Outbound Rules**      | Each outbound rule with its type, protocol, ports, destination, and description.                                       |
| **Associated Services** | The instances and inference endpoints that have the group attached.                                                    |

## Rules for common setups

Each setup below keeps one outbound rule of **Type** **All Traffic** to **Any Network**, so the resource can
reach the internet, and adds the inbound rules shown.

| Setup                                | Inbound rules                                                                                                              |
| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------- |
| SSH from your own address only       | **SSH**, **Source** **Manual Network**, with your public IPv4 address in **IP Address**                                    |
| A website or web app                 | **Custom TCP** on ports 80 and 443 from **Any Network**, plus an **SSH** rule if you sign in over SSH                      |
| An app or API on its own port        | **Custom TCP** on that port, such as 8000, from **Any Network** or from one **Manual Network** address                     |
| Traffic from your MyAccount VPC only | **Custom TCP** on the app's port, **Source** **MyAccount VPC Network**, with the MyAccount region, project, and VPC chosen |

Open only the ports a resource needs. Name each group for its purpose, such as `ssh-access`,
`web-server`, or `inference-internal`, so the right one is easy to pick. Review the rules from time to time
and keep only the ones still in use. For SSH-only access from anywhere, the default group is ready to
use.

## Billing

Security groups are free of charge, whether you create one, change its rules, or attach it to a
resource.

## What you can do

[Create a security group](/tir/tir-security-group/how-to/create-a-security-group/),
[manage its rules](/tir/tir-security-group/how-to/manage-security-group-rules/),
[edit it](/tir/tir-security-group/how-to/edit-a-security-group/),
[attach or detach it](/tir/tir-security-group/how-to/attach-or-detach-a-security-group/), or
[delete it](/tir/tir-security-group/how-to/delete-a-security-group/).