Project security groups

Security groups control network traffic to your instances by applying IP filter rules that define which connections are permitted. Use security groups to isolate project workloads and ensure that only authorized traffic reaches your instances.

All projects have a default security group that is applied to any instance that has no other defined security group. Unless you change the default values, this security group denies all incoming traffic and allows only outgoing traffic from your instance.

You can apply a security group directly to an instance during instance creation, or to a port on the running instance.

Note
You cannot apply a role-based access control (RBAC)-shared security group directly to an instance during instance creation. To apply an RBAC-shared security group to an instance you must first create the port, apply the shared security group to that port, and then assign that port to the instance. For more information, see the Additional resources section below.

Do not delete the default security group without creating groups that allow required egress. For example, if your instances use DHCP and metadata, your instance requires security group rules that allow egress to the DHCP server and metadata agent.

Create a security group
Copy link

Create a security group to define the IP filter rules that control network traffic to your instances and ports, so that you can secure your workloads against unauthorized access.

Before you begin
Copy link

  • The administrator has created a project for you and has provided you with a clouds.yaml file for you to access the cloud.
  • You have installed the python-openstackclient package.

Procedure
Copy link

  1. Confirm that the system OS_CLOUD variable is set for your cloud: 
    $ echo $OS_CLOUD
my_cloud

    Reset the variable if necessary:

    $ export OS_CLOUD=my_other_cloud

    As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

  2. Optional: To ensure the security group you need does not already exist, review the available security groups and their rules: 
    $ openstack security group list
$ openstack security group rule list <sec_group>
    • Replace <sec_group> with the name or ID of the security group that you retrieved from the list of available security groups.
  3. Create your security group: 
    $ openstack security group create [--stateless] mySecGroup
    • Optional: Include the --stateless option to create a stateless security group.

      Security groups are stateful by default.

  4. Add rules to your security group: 
    $ openstack security group rule create --protocol <protocol> \
[--dst-port <port-range>] \
[--remote-ip <ip-address> | --remote-group <group>] \
[--ingress | --egress] mySecGroup
    • Replace <protocol> with the name of the protocol you want to allow to communicate with your instances.
    • Optional: Replace <port-range> with the destination port or port range to open for the protocol. Required for IP protocols TCP, UDP, and SCTP. Set to -1 to allow all ports for the specified protocol. Separate port range values with a colon.
    • Optional: You can allow access only from specified IP addresses by using --remote-ip to specify the remote IP address block, or --remote-group to specify that the rule only applies to packets from interfaces that are a member of the remote group. If using --remote-ip, replace <ip-address> with the remote IP address block. You can use CIDR notation. If using --remote-group, replace <group> with the name or ID of the existing security group. If neither option is specified, then access is allowed to all addresses, as the remote IP access range defaults (IPv4 default: 0.0.0.0/0; IPv6 default: ::/0).
    • Specify the direction of network traffic the protocol rule applies to, either incoming (ingress) or outgoing (egress). If not specified, defaults to ingress. Note

      If you created a stateless security group, and you created a rule to allow outgoing TCP traffic from a port that is in the stateless security group, you must also create a rule that allows incoming replies.

  5. Repeat the previous step until you have created rules for all the protocols that you want to allow to access your instances.

    The following example creates a rule to allow SSH connections to instances in the security group mySecGroup:

    $ openstack security group rule create --protocol tcp \
 --dst-port 22 mySecGroup

Add a security group rule
Copy link

Add a rule to a security group to open specific ports and protocols, so that your instances can communicate with authorized external resources while maintaining secure access controls.

About this task
Copy link

By default, rules for a new group only provide outgoing access. You must add new rules to provide additional access.

Procedure
Copy link

  1. In the dashboard, select Project > Compute > Access & Security.
  2. On the Security Groups tab, click Manage Rules for the security group that you want to edit.
  3. Click Add Rule to add a new rule.
  4. Specify the rule values, and click Add.

    The following rule fields are required:

    Rule

    Rule type. If you specify a rule template (for example, 'SSH'), its fields are automatically filled in:

    • TCP: Typically used to exchange data between systems, and for end-user communication.
    • UDP: Typically used to exchange data between systems, particularly at the application level.
    • ICMP: Typically used by network devices, such as routers, to send error or monitoring messages.
    Direction
    Ingress (inbound) or Egress (outbound).
    Open Port

    For TCP or UDP rules, the Port or Port Range (single port or range of ports) to open:

    • For a range of ports, enter port values in the From Port and To Port fields.
    • For a single port, enter the port value in the Port field.
    Type
    The type for ICMP rules; must be in the range '-1:255'.
    Code
    The code for ICMP rules; must be in the range '-1:255'.
    Remote

    The traffic source for this rule:

    • CIDR (Classless Inter-Domain Routing): IP address block, which limits access to IPs within the block. Enter the CIDR in the Source field.
    • Security Group: Source group that enables any instance in the group to access any other group instance.

Delete a security group rule
Copy link

Delete a security group rule to close unused ports and revoke specific network access, so that you can reduce security risks and block unwanted traffic to your instances.

About this task
Copy link

Note
You cannot undo the delete action.

Procedure
Copy link

  1. In the dashboard, select Project > Compute > Access & Security.
  2. On the Security Groups tab, click Manage Rules for the security group.
  3. Select the security group rule, and click Delete Rule.
  4. Click Delete Rule again.

Delete a security group
Copy link

Delete a security group that is no longer associated with any ports to remove outdated IP filter rules and keep your project security configuration clean.

Before you begin
Copy link

  • The administrator has created a project for you and has provided you with a clouds.yaml file for you to access the cloud.
  • You have installed the python-openstackclient package.

Procedure
Copy link

  1. Confirm that the system OS_CLOUD variable is set for your cloud: 
    $ echo $OS_CLOUD
my_cloud

    Reset the variable if necessary:

    $ export OS_CLOUD=my_other_cloud

    As an alternative, you can specify the cloud name by adding the --os-cloud <cloud_name> option each time you run an openstack command.

  2. Retrieve the name or ID of the security group that you want to delete: 
    $ openstack security group list
  3. Retrieve a list of the available ports: 
    $ openstack port list
  4. Check each port for an associated security group: 
    $ openstack port show <port-uuid> -c security_group_ids

    If the security group you want to delete is associated with any of the ports, then you must first remove the security group from the port. For more information, see Provide public access to an instance.

  5. Delete the security group: 
    $ openstack security group delete <group> [<group> ...]

    Replace <group> with the ID of the group that you want to delete. You can delete more than one group at a time by specifying a space-delimited list of the IDs of the groups to delete.