Security groups
A security group is a set of firewall rules that applies to every VM in it. Each VM has one to five groups; traffic is allowed if any of its groups allows it. Rules are stateful: if a rule lets a connection in, its replies go out, and the other way round.
A rule allows traffic. There are no deny rules: anything no rule allows is dropped.
| Field | Values |
|---|---|
| Direction | ingress (inbound) or egress (outbound) |
| Protocol | tcp, udp, icmp or all |
| Ports | For TCP and UDP: one port (22) or a range (8000-8100) |
| Remote | An address range (203.0.113.0/24, 2001:db8::/32) or another security group |
| IP version | ipv4 or ipv6; taken from the range, required when the remote is a group |
A rule that names a group allows traffic from (or to) every VM in that group, whatever their addresses are. Use it to let a web tier reach a database tier without listing IPs.
What new groups allow
Section titled “What new groups allow”| Group | Inbound | Outbound |
|---|---|---|
A VPC’s default group |
From other VMs in the same group; ICMPv6 from anywhere (needed for IPv6 to work) | Everything, IPv4 and IPv6 |
| A group you create | Nothing | Everything, IPv4 and IPv6 |
Removing the outbound rules blocks the VM’s outbound traffic too, except replies to connections that an inbound rule allowed.
Open a port
Section titled “Open a port”Open Security groups, pick the group, Add rule. Rules read as sentences, for example “allow TCP 443 from 0.0.0.0/0”. They apply at once, to running VMs too.
SG=$(tebib -o json security-group create web --vpc "$VPC" --description "Public web servers" --wait | jq -r .id)tebib security-group rule add "$SG" --protocol tcp --port 443 --cidr 0.0.0.0/0 --description "HTTPS"tebib security-group rule add "$SG" --protocol tcp --port 443 --cidr ::/0 --description "HTTPS (IPv6)"tebib security-group rule add "$SG" --protocol tcp --port 80 --cidr 0.0.0.0/0 --description "HTTP"tebib security-group show "$SG"A tier that only another tier can reach
Section titled “A tier that only another tier can reach”DB_SG=$(tebib -o json security-group create db --vpc "$VPC" --wait | jq -r .id)tebib security-group rule add "$DB_SG" --protocol tcp --port 5432 --group "$SG" --ip-version ipv4 --description "Postgres from web"Change a VM’s groups
Section titled “Change a VM’s groups”Pick groups when you create the VM (default: the VPC’s default group). To change them later, replace the whole list; the change applies to the running VM.
On the VM’s page, Networking → Security groups.
tebib vm set-security-groups "$VM" "$SG" "$DEFAULT_SG" --waitA VM must always be in at least one group; groups must be in the VM’s VPC.
Delete
Section titled “Delete”A group in use can’t be deleted: first take it off every VM, and remove the rules in other groups that name it. A VPC’s default group can’t be deleted on its own: it goes with the VPC.
Limits
Section titled “Limits”| Default | |
|---|---|
| Security groups per project, including default groups | 50 |
| Rules per group | 60 |
| Groups per VM | 5 |
Traffic TebibHost blocks for everyone
Section titled “Traffic TebibHost blocks for everyone”Whatever your rules say:
- Outbound TCP port 25 (SMTP) is blocked on every public address. Send mail through a relay on port 587 or 465.
- New outbound connections are capped at 500 a second (bursts to 1000) per public IPv4 address and per VPC IPv6 range. Normal servers never notice; scans and floods do.
See the acceptable use policy.