---
title: "Security Groups FAQ"
description: "Short answers about TIR security groups, the default group, and attaching rules, each linking to the full page."
content_type: "faq"
product: "tir-security-group"
platform: "TIR"
url: "/tir/tir-security-group/faq/"
---

# Security Groups FAQ

## What does the default security group allow?

**Default-SSH-Security-Group** allows SSH (port 22) from any network and all outbound traffic.
This group is fixed. For other access, create your own group with the rules you need. See
[Security groups and rules](/tir/tir-security-group/concepts/security-groups/).

## How do I limit SSH to my own address?

Create a security group with an inbound **SSH** rule whose **Source** is **Manual Network**, with
your own address in **IP Address**. Add an outbound rule too, then attach the group to the resource
instead of the default group. See
[Create a security group](/tir/tir-security-group/how-to/create-a-security-group/).

## Which resources use security groups?

Instances, VMs, inference services, and Slurm clusters. You attach a group from the resource's own screen.
See [Attach or detach a security group](/tir/tir-security-group/how-to/attach-or-detach-a-security-group/)
and, for a VM, [Attach security groups to a VM](/tir/tir-vm/how-to/attach-security-groups-to-a-vm/).

## Which ports can a rule open?

Ports 22, 80, 443, and 1024 to 65535. Add each port on its own: the field takes one port at a time, and a hyphenated range is refused.
See [Manage security group rules](/tir/tir-security-group/how-to/manage-security-group-rules/).

## Can an inbound rule allow all traffic?

No. An inbound rule is **Custom TCP** or **SSH**, with the ports you list. **All Traffic** is for outbound
rules.

## Can a rule allow a whole address range?

No. **Manual Network** takes one IPv4 address, and the rule covers that address only. Add a rule for each
address, or use **MyAccount VPC Network** to allow a MyAccount VPC.

## Do rule changes reach resources that already have the group?

Yes. Resources that have the group attached pick up the new rules in the background. See
[Apply the changes](/tir/tir-security-group/how-to/manage-security-group-rules/#apply-the-changes).

## Does a group need both inbound and outbound rules?

Yes. A group keeps at least one inbound rule and one outbound rule at all times.

## Can I delete a security group that is attached?

Yes, unless it is the only group on an instance with SSH keys or on an inference service with a
reserved IP. Those resources need a group attached. Once the group is deleted, the resources that had it
stop following its rules. See
[Delete a security group](/tir/tir-security-group/how-to/delete-a-security-group/).

## How many security groups can I attach at once?

Up to five at a time. See
[Attach or detach a security group](/tir/tir-security-group/how-to/attach-or-detach-a-security-group/).

## Are security groups charged?

No. Creating a group, changing its rules, and attaching it are free. See
[Security groups and rules](/tir/tir-security-group/concepts/security-groups/#billing).