---
title: "Attach security groups to a VM"
description: "Attach security groups to a TIR Virtual Machine to control which traffic reaches it, open a port for an app, and keep SSH working."
content_type: "how-to"
product: "tir-vm"
platform: "TIR"
url: "/tir/tir-vm/how-to/attach-security-groups-to-a-vm/"
topic: ["network"]
---

# Attach security groups to a VM

Attach security groups to a TIR Virtual Machine (VM) to decide which traffic can reach it. Each
inbound rule in a group lets one range of addresses reach the ports it lists, and 0.0.0.0/0 means
anyone on the internet. A VM with security groups accepts only the traffic its groups allow, so this
is also how you open a port for an app you run on the VM.

## Before you begin

- A security group with the rules you want. To make one, see [Create a security
  group](/tir/tir-security-group/how-to/create-a-security-group/), and to add rules, [Manage security
  group rules](/tir/tir-security-group/how-to/manage-security-group-rules/).
- Permission to update VMs in the project. See [TIR
  Access Control](/tir/tir-iam/).

A VM with SSH keys needs at least one group that allows port 22, so that you can sign in to it.

## Attach security groups

1. In **Manage VMs**, select the VM's name, go to **Network & Security**, and select the **Security
   Groups** side tab.
2. In **Select Security Groups**, pick up to five groups.
3. Select **Attach**.

To check what an attached group allows, expand it on the tab to see its **Inbound Rules** and
**Outbound Rules**.

On the **Create VM** form, the **Security Group** field does the same for a new VM. See [Create a
VM](/tir/tir-vm/how-to/create-a-vm/).

## Limit SSH to your own addresses

Every project has a default SSH security group, which allows SSH on port 22 from every address. A new VM
gets this group when you leave **Security Group** empty, and the group's rules stay fixed. To allow SSH only from your
office or your home address:

1. [Create a security group](/tir/tir-security-group/how-to/create-a-security-group/) with an SSH
   rule on port 22 whose source is your address range.
2. Attach it to the VM, as in [Attach security groups](#attach-security-groups).
3. Sign in over SSH to check that it works.
4. Detach the default SSH group, as in [Detach a security group](#detach-a-security-group).

## Open a port for an app

To reach a web server, an API, or a dashboard that you run on the VM from outside:

1. Add an inbound rule for the app's port to a security group of your own. A rule takes port 80, 443,
   or any port from 1024 to 65535, with the type Custom TCP. Ports 22 and 8888 are
   reserved, so pick a different port for your app. See [Manage security group
   rules](/tir/tir-security-group/how-to/manage-security-group-rules/).
2. Attach that group to the VM, as in [Attach security groups](#attach-security-groups).
3. On the VM, make the app listen on all addresses, `0.0.0.0`, instead of `localhost`.

The port is the same number outside and inside the VM: an app on port 8080 inside the VM answers on
port 8080 of its public IP. Check it from your own computer, for example with
`curl http://<ip-address>:8080`, where `<ip-address>` is the VM's public IP.

## Detach a security group

Detaching a group closes the ports it opened, which can cut off your own access.

1. On the **Security Groups** side tab, select **Detach Security Group**, the minus button on the
   group's row.
2. In **Detach Security Group**, tick "Are you sure you want to detach this security group?" and
   select **Detach**.

While the VM has SSH keys, it must keep at
least one security group, so attach the replacement before you detach the last one.

To sign in once a group allows port 22, see [Connect to a VM over
SSH](/tir/tir-vm/how-to/connect-to-a-vm-over-ssh/). For help with a message, see [Troubleshooting TIR
Virtual Machines](/tir/tir-vm/troubleshooting/tir-vm/#you-can-attach-a-maximum-of-5-security-groups-at-a-time).