Skip to content
Origin Cloud Docs

Network / Concept

Security groups

Updated · 6 min read

Security groups are stateful firewalls on each network interface. Learn how rules and group references work, what the default group allows, and how to change rules.

On this page6 sections

A security group is a firewall for a network interface. Its ingress rules say what may reach the instance and its egress rules say what the instance may send, by protocol, port, and a peer: an IP range or another security group in the same VPC. Security groups apply to every packet to or from the interface, including traffic between instances in the same subnet.

How rules are evaluated

Security groups are stateful. Once a rule allows a connection, its reply traffic is allowed automatically, without a rule in the other direction. Anything no rule allows is denied.

Each rule has:

  • A protocol: any, tcp, udp or icmp. icmp means ICMP for an IPv4 peer and ICMPv6 for an IPv6 peer, all message types.
  • A port: a single port, a range such as 8000-8100, or any. A port only applies with tcp or udp. ICMP has no ports, so an icmp rule must use any; a rule with any other port is refused.
  • A peer: an IP range such as 203.0.113.0/24 or 0.0.0.0/0, or a security group.

An interface can carry several groups. You choose them when you launch the instance; see Network interfaces. You can’t change an interface’s security groups afterwards. To change what reaches an instance, change the rules of the groups it carries (see Change a security group’s rules), or launch a new instance with other groups. Address resolution (ARP and IPv6 neighbor discovery) always passes, so an interface can always be found by its neighbors. ICMP that belongs to a connection already allowed, such as the reply to the instance’s own ping or a “fragmentation needed” message, passes too; an icmp rule is what allows new ICMP, such as a ping from outside.

An instance is never reachable without its security groups. Until the rules of every group on its interface are in place, usually within a few seconds of the start, it passes no traffic except address resolution.

Rules that name a security group

A rule whose peer is a security group matches the private addresses of every interface that currently carries that group, on any machine. The match follows membership as you launch and terminate instances. A group with no members matches nothing.

Naming a group in its own rules is the usual way to let the members of a cluster talk to each other. A rule can name only a group in the same VPC; naming a group of another VPC is refused.

Group references match private addresses only. Traffic that arrives through a Floating IP, including from an instance in the same VPC, carries a public source address and doesn’t match. See Floating IPs.

Default security group

Every VPC gets a default security group, which new interfaces carry when you don’t name one. It has:

  • An ingress rule that allows all traffic from members of the group itself.
  • Ingress rules that allow SSH (TCP 22), HTTP (TCP 80), HTTPS (TCP 443) and ICMP from anywhere, each over IPv4 (0.0.0.0/0) and IPv6 (::/0).
  • Two egress rules that allow all outbound IPv4 and IPv6 traffic.

So an instance launched with the default group answers ping and accepts SSH and web traffic from the internet as soon as it has a public address, and instances that share the group can reach each other on any port. Every other port is closed to anything outside the group until you add a rule.

SSH is open to everyone because instances accept only key-based logins: every launch takes a key pair, and password logins are refused. To allow SSH from one address range only, replace the two SSH rules as shown below.

A VPC created before these rules were part of the default keeps the rules its default group had; add the ones you want with update-security-group-rules.

Change a security group’s rules

update-security-group-rules replaces both rule lists of a group, so you state both every time. For example, to restrict the default group’s SSH to one IPv4 range while keeping HTTP, HTTPS and ping open to everyone, and keep all outbound traffic allowed:

terminal
origin network update-security-group-rules \
  --security-group-urn <security-group-urn> \
  --ingress-rule 'protocol=tcp,port=22,ip-range=198.51.100.0/24' \
  --ingress-rule 'protocol=tcp,port=80,ip-range=0.0.0.0/0' \
  --ingress-rule 'protocol=tcp,port=80,ip-range=::/0' \
  --ingress-rule 'protocol=tcp,port=443,ip-range=0.0.0.0/0' \
  --ingress-rule 'protocol=tcp,port=443,ip-range=::/0' \
  --ingress-rule 'protocol=icmp,port=any,ip-range=0.0.0.0/0' \
  --ingress-rule 'protocol=icmp,port=any,ip-range=::/0' \
  --ingress-rule 'protocol=any,port=any,security-group-urn=<security-group-urn>' \
  --egress-rule 'protocol=any,port=any,ip-range=0.0.0.0/0' \
  --egress-rule 'protocol=any,port=any,ip-range=::/0'

The example replaces both default SSH rules with one IPv4 rule, so SSH over IPv6 is no longer allowed. Add an SSH rule for an IPv6 range if you need one.

Read the current rules with get-security-group first, and repeat the ones you want to keep. For the rules about stating lists in full, see Rule sets are replaced as a whole.

A change applies to every instance whose interface carries the group, usually within a few seconds. You don’t restart the instance.

Create and delete security groups

create-security-group adds a group to a VPC with no rules, so it denies everything in both directions until you add rules. Use extra groups when different workloads need different rules.

The API can seed the rules when it creates the group: the createSecurityGroup mutation takes optional ingressRules and egressRules. Leave them out for an empty group, as the CLI creates. For example, a group that allows HTTPS in from anywhere over IPv4 and all outbound IPv4 traffic:

GraphQL
mutation {
  network {
    createSecurityGroup(input: {
      vpcUrn: "<vpc-urn>"
      ingressRules: [
        { protocol: TCP, port: { from: 443 }, peer: { ipRange: "0.0.0.0/0" } }
      ]
      egressRules: [
        { protocol: ANY, port: {}, peer: { ipRange: "0.0.0.0/0" } }
      ]
    }) {
      urn
    }
  }
}

Omit from and to in port for any port, set only from for one port, or both for a range.

A VPC’s default security group can’t be deleted on its own; it goes with the VPC. Any other group can’t be deleted while a network interface still carries it.