---
title: "Manage security group rules"
description: "Add and remove the inbound and outbound rules of a TIR security group, with the types, ports, and sources a rule accepts."
content_type: "how-to"
product: "tir-security-group"
platform: "TIR"
url: "/tir/tir-security-group/how-to/manage-security-group-rules/"
topic: ["security-groups"]
relationships: {"requires":["/tir/tir-security-group/how-to/create-a-security-group/"]}
---

# Manage security group rules

Add, change, or remove the rules of a security group. Resources that already have the group
attached pick up the change in the background.

## Before you begin

You need a role with Update permission on security groups. The default group,
**Default-SSH-Security-Group**, keeps its rules as they are; for different rules, create your own
group. A group must always keep at least one inbound and one outbound rule.

## Open the rules

1. In TIR, open your project. In the side menu, under **PLATFORM SERVICES**, select **Networking**,
   then **Security Groups**.
2. Either open the **Actions** menu in the group's row and select **Manage Rules**, or select the
   group, open its **Inbound Rules** or **Outbound Rules** tab, and select **Update Rules**.

In **Manage Rules**, use the **Inbound Rules** and **Outbound Rules** tabs.

## Add a rule

1. Open the **Inbound Rules** or **Outbound Rules** tab.
2. Fill in the rule form:
   - **Type**. Inbound offers **Custom TCP** and **SSH**. Outbound offers **All Traffic**,
     **Custom TCP**, and **SSH**. **All Traffic** is for outbound rules only.
   - **Protocol**. **TCP** for **Custom TCP** and **SSH**, **All** for **All Traffic**.
   - **Ports**. Type a port and press Space or a comma to add it, one port at a time. The allowed
     ports are 22, 80, 443, and 1024 to 65535. Every rule except **All Traffic** needs at
     least one port, and **SSH** fills in port 22 for you. A range typed with a hyphen is
     refused, so add each port.
   - **Source** (inbound) or **Destination** (outbound): **Any Network**, **Manual Network**, or
     **MyAccount VPC Network** for an inbound rule only.
   - **Description (Optional)**.
3. Select **Add Rule**.

The rule is marked **NEW**, and the group keeps its current rules until you apply the changes.

### Choose where traffic comes from or goes to

- **Any Network** matches every address.
- **Manual Network** adds **IP Address**. Type one IPv4 address, such as 192.168.1.0. The rule
  covers that single address only.
- **MyAccount VPC Network**, for inbound rules, adds **MyAccount Region**, **MyAccount Project**,
  and **VPC**. Your user needs MyAccount VPC permission to choose them.

## Remove a rule

Select **Remove** next to a rule. A new rule disappears at once. A rule that already exists is
marked **TO REMOVE** and stays until you apply the change; to keep it, select **Undo**.

## Apply the changes

1. Select **Apply All Changes**. It is available while at least one inbound and one outbound rule
   remain; otherwise the tab says "(At least one rule required)".
2. In **Update Rules**, read the confirmation. It reminds you that SSH needs an inbound rule for
   port 22. Select **Confirm**.

## Review the rules

Open the group's **Inbound Rules** and **Outbound Rules** tabs to see the rules, each with its
**Type**, **Protocol**, **Ports**, **Source** or **Destination**, and **Description**.

To open a port on an instance, see
[Open a port on an instance](/tir/tir-instance/how-to/open-a-port-on-an-instance/). For help with a
refused rule, see
[Troubleshooting Security Groups](/tir/tir-security-group/troubleshooting/tir-security-group/).