Security groups

#How a security group works

A security group is a set of rules for what can reach your virtual machines, and what they can reach in turn. It applies to standard VPSes; a VM in a VPC is filtered by its subnet's network ACL instead.

• Inbound rules decide what traffic can reach the machines. Anything no rule allows is blocked.
• Outbound rules decide what the machines can reach. With none, they cannot reach anything, including package mirrors and your own APIs.
• A machine uses one security group at a time, and you can only change which one while it is stopped.
• One group can cover many machines, and editing a rule changes all of them at once. There is no per-machine override.

Security groups are free.

#Create a security group

Go to Security groups and press Create security group.

1. Name: up to 255 characters. Name it after what it protects, not what it allows: api-internal, not open-8080.
2. Inbound rules: press Add rule for each one. A new group starts with none.
3. Outbound rules: a new group starts with one rule allowing all traffic out, which most machines need.

The summary says whether the group is Exposed to the internet or Internal only. A group needs at least one rule, inbound or outbound. Press Create security group.

You can also create one from the Network section of the create form, starting from a preset: Web server, Internal service or Locked down.

#Writing a rule

Each rule has four parts:

#Apply it to a machine

A machine has to be stopped to change its security group, and the new rules apply when it starts again.

• When you create a machine, choose the group in the Network section.
• From the machine: power it off, then on its Networking tab use Change security group.
• From the group: on its page, under Applied to, press Attach a VM and choose a stopped machine. It moves off whatever group it had.

#Edit rules

Open the group and press Edit inbound rules or Edit outbound rules. Add, change or delete rows, then Save rules. The page tells you which machines the change will reach before you save, and the group shows Applying… until it is in place. If a change does not apply, the group's page says so; check the rules and save again.

#Narrow SSH without locking yourself out

1. Make sure you have another way in: the serial console works whatever the rules say.
2. Edit the inbound rules and change the SSH rule's source from Anywhere to My IP, or to the block your office uses.
3. Save, then open a new SSH session before you close the one you have.

If your address changes, as it often does on home broadband or mobile data, update the rule, or connect through the serial console to fix things.

#Read a group at a glance

The Security groups list shows each group's inbound and outbound rules, how many machines use it, and its exposure in plain words, rather than a rule count. "3 rules" tells you nothing about whether you are open to the internet. On a group's page, What this security group actually allows spells it out.

#Machines with a private database interface

A standard VPS can have a second interface on the private database network, 10.250.0.0/20, to reach managed databases. A group applies to every interface of a machine, so while any machine on a group has that interface, the group may not admit anything from 10.250.0.0/20: no inbound rule from 0.0.0.0/0, 10.0.0.0/8 or an address inside the range, ICMP included. The default group's ICMP from anywhere rule is one of these. Narrowing a group shows the ranges to use instead of 0.0.0.0/0.

#Groups as a source for databases

You can also attach a group to a managed database. There it is only a list of address ranges: the inbound rules that admit TCP on the database's port count, and nothing is opened on any machine.

#Delete a security group

On the group's page, press Delete and confirm. The dialog says how many machines use it right now; move them to another group first. A group attached to a database cannot be deleted either: detach it from the database first. Deleting cannot be undone.