Manage security group rules

Add, change, or remove the rules of a security group. Resources that already have the group attached pick up the change in the background.

Before you begin

You need a role with Update permission on security groups. The default group, Default-SSH-Security-Group, keeps its rules as they are; for different rules, create your own group. A group must always keep at least one inbound and one outbound rule.

Open the rules

1. In TIR, open your project. In the side menu, under PLATFORM SERVICES, select Networking, then Security Groups.
2. Either open the Actions menu in the group’s row and select Manage Rules, or select the group, open its Inbound Rules or Outbound Rules tab, and select Update Rules.

In Manage Rules, use the Inbound Rules and Outbound Rules tabs.

Add a rule

1. Open the Inbound Rules or Outbound Rules tab.
2. Fill in the rule form:
   • Type. Inbound offers Custom TCP and SSH. Outbound offers All Traffic, Custom TCP, and SSH. All Traffic is for outbound rules only.
   • Protocol. TCP for Custom TCP and SSH, All for All Traffic.
   • Ports. Type a port and press Space or a comma to add it, one port at a time. The allowed ports are 22, 80, 443, and 1024 to 65535. Every rule except All Traffic needs at least one port, and SSH fills in port 22 for you. A range typed with a hyphen is refused, so add each port.
   • Source (inbound) or Destination (outbound): Any Network, Manual Network, or MyAccount VPC Network for an inbound rule only.
   • Description (Optional).
3. Select Add Rule.

The rule is marked NEW, and the group keeps its current rules until you apply the changes.

Choose where traffic comes from or goes to

• Any Network matches every address.
• Manual Network adds IP Address. Type one IPv4 address, such as 192.168.1.0. The rule covers that single address only.
• MyAccount VPC Network, for inbound rules, adds MyAccount Region, MyAccount Project, and VPC. Your user needs MyAccount VPC permission to choose them.

Remove a rule

Select Remove next to a rule. A new rule disappears at once. A rule that already exists is marked TO REMOVE and stays until you apply the change; to keep it, select Undo.

Apply the changes

1. Select Apply All Changes. It is available while at least one inbound and one outbound rule remain; otherwise the tab says “(At least one rule required)”.
2. In Update Rules, read the confirmation. It reminds you that SSH needs an inbound rule for port 22. Select Confirm.

Review the rules

Open the group’s Inbound Rules and Outbound Rules tabs to see the rules, each with its Type, Protocol, Ports, Source or Destination, and Description.

To open a port on an instance, see Open a port on an instance. For help with a refused rule, see Troubleshooting Security Groups.