Skip to main content

Assign a security group

To be able to assign a security group to a port, traffic filtering (port security) must be enabled in the port network. You can check the filtering status in the Control panel: on the top menu, click Products → Cloud Servers → Network → Private networks or Public networks tab. A network with enabled filtering is marked with .

When creating a port, a default security group named default is assigned to it. You can also specify a different security group when creating a port or server; it will be assigned instead of the default one.

You can assign a security group:

Assign a security group when creating a port

You can assign a security group when creating a port only for a port in a public or private subnet. If you are setting up a port with a direct public IP address, first add the port to the server, then assign a security group to it.

  1. Open the OpenStack CLI.

  2. Create a port with a security group in a private or public subnet:

    openstack port create \
      --network <network> \
      --fixed-ip subnet=<subnet>,ip-address=<port_ip_address> \
      --security-group <security_group> \
      <port_name>

    Specify:

    • <network> — network ID or name, can be viewed using the openstack network list command. For a public subnet, this matches the <subnet> parameter;
    • <subnet> — subnet ID or name, can be viewed using the openstack subnet list;
    • <port_ip_address> — port IP address;
    • <security_group> — security group ID or name, can be viewed using the openstack security group list;
    • <port_name> — port name.

  3. Add a port to a server:

    openstack server add port <server> <port>

    Specify:

    • <server> — cloud server ID or name, can be viewed using the openstack server list;
    • <port> — ID or name of the port you created in step 2, can be viewed using the openstack port list.

Assign a group to an existing cloud server port

warning

After assigning a group to a port, all active sessions that do not comply with the group rules will be dropped.

  1. In the Control panel, on the top menu, click Products and select Cloud Servers.

  2. Open the server page → Ports tab.

  3. In the port card, in the security groups field, click .

  4. In the Security groups field, check the groups you want to assign to the port, or click New security group and create a group.

  5. Click Save.

Assign a group when creating a server

The group will only be assigned to ports created together with the server.

  1. Open the OpenStack CLI.

  2. Create a cloud server in a subnet specifying a security group:

    openstack server create \
      [--image <image> | --volume <volume> | --snapshot <snapshot>] \
      --flavor <flavor> \
      --availability-zone <pool_segment> \
      --nic net-id=<net_uuid> \
      --security-group <security_group> \
      --key-name <key_name> \
      <server_name>

    Specify:

    • source type:

      • --image <image> — to create a server from a pre-built or custom image. The <image> parameter is the image ID or name, which can be viewed using the openstack image list;
      • --volume <volume> — to create a server from a network volume. The <volume> parameter is the disk ID or name, which can be viewed using the openstack volume list;
      • --snapshot <snapshot> — to create a server from a snapshot. The <snapshot> parameter is the snapshot ID or name, which can be viewed using the openstack snapshot list;

    • <flavor> — flavor ID or name. Flavors correspond to cloud server configurations and define the number of vCPU, RAM, and local disk size (optional) of the server. You can use fixed-configuration flavors or create a flavor. For example, 1015 — ID for creating a server with a fixed Standard configuration with 4 vCPU, 16 GB RAM in the ru-9 pool. A list of flavors can be viewed using the openstack flavor list command or in the List of fixed-configuration flavors in all pools table;

    • <pool_segment> — pool segment where the cloud server will be created, e.g., ru-9a. A list of available pool segments can be viewed in the Product availability by location guide;

    • <net_uuid> — ID of the private or public network to which the server will be connected, can be viewed using the openstack network list;

    • <key_name> — name of the service user SSH key pair. If SSH keys are not created, generate them. The list can be viewed using the openstack keypair list;

    • <security_group> — security group ID or name, can be viewed using the openstack security group list;

    • optional: --block-device-mapping vdb=<extra_volume> — to add an additional disk. The <extra_volume> parameter is the additional disk ID or name, which can be viewed using the openstack volume list;

    • optional: --property x_cloud_smt_enabled=false — disable Hyper-Threading (SMT). If the parameter is not specified, Hyper-Threading (SMT) will be enabled by default. Can only be used with flavors that support dedicated cores. A list of flavors can be viewed in the List of fixed-configuration flavors in all pools table;

    • optional: --property x_cloud_numa_nodes=1 — resource placement on a single NUMA node. Can only be used with flavors that support dedicated cores. A list of flavors can be viewed in the List of fixed-configuration flavors in all pools table;

    • optional: --tag <tag_name> --os-compute-api-version 2.52 — tag to add additional information about the server. The <tag_name> parameter is the tag name;

    • optional: --tag preemptible --os-compute-api-version 2.72 — tag to create a preemptible server;

    • optional: --user-data <user_data.file> — to specify a script to run during the first boot of the operating system. The <user_data.file> parameter is the path to the Base64-encoded script. Example scripts can be viewed in the User data guide;

    • <server_name> — server name.