Attach security groups to a VM

Attach security groups to a TIR Virtual Machine (VM) to decide which traffic can reach it. Each inbound rule in a group lets one range of addresses reach the ports it lists, and 0.0.0.0/0 means anyone on the internet. A VM with security groups accepts only the traffic its groups allow, so this is also how you open a port for an app you run on the VM.

Before you begin

• A security group with the rules you want. To make one, see Create a security group, and to add rules, Manage security group rules.
• Permission to update VMs in the project. See TIR Access Control.

A VM with SSH keys needs at least one group that allows port 22, so that you can sign in to it.

Attach security groups

1. In Manage VMs, select the VM’s name, go to Network & Security, and select the Security Groups side tab.
2. In Select Security Groups, pick up to five groups.
3. Select Attach.

To check what an attached group allows, expand it on the tab to see its Inbound Rules and Outbound Rules.

On the Create VM form, the Security Group field does the same for a new VM. See Create a VM.

Limit SSH to your own addresses

Every project has a default SSH security group, which allows SSH on port 22 from every address. A new VM gets this group when you leave Security Group empty, and the group’s rules stay fixed. To allow SSH only from your office or your home address:

1. Create a security group with an SSH rule on port 22 whose source is your address range.
2. Attach it to the VM, as in Attach security groups.
3. Sign in over SSH to check that it works.
4. Detach the default SSH group, as in Detach a security group.

Open a port for an app

To reach a web server, an API, or a dashboard that you run on the VM from outside:

1. Add an inbound rule for the app’s port to a security group of your own. A rule takes port 80, 443, or any port from 1024 to 65535, with the type Custom TCP. Ports 22 and 8888 are reserved, so pick a different port for your app. See Manage security group rules.
2. Attach that group to the VM, as in Attach security groups.
3. On the VM, make the app listen on all addresses, 0.0.0.0, instead of localhost.

The port is the same number outside and inside the VM: an app on port 8080 inside the VM answers on port 8080 of its public IP. Check it from your own computer, for example with curl http://<ip-address>:8080, where <ip-address> is the VM’s public IP.

Detach a security group

Detaching a group closes the ports it opened, which can cut off your own access.

1. On the Security Groups side tab, select Detach Security Group, the minus button on the group’s row.
2. In Detach Security Group, tick “Are you sure you want to detach this security group?” and select Detach.

While the VM has SSH keys, it must keep at least one security group, so attach the replacement before you detach the last one.

To sign in once a group allows port 22, see Connect to a VM over SSH. For help with a message, see Troubleshooting TIR Virtual Machines.