The default posture
What an interface with no group does, and the one rule a new group starts
with.
Writing rules
Required fields, the source that is not optional, and why there is no
update.
Attaching
Membership is a set you replace, not a list you append to.
Platform rules
Traffic that is always allowed, and the one port that is always blocked.
The default posture
Two different defaults matter here, and confusing them is the usual source of “my rules do nothing”.- An interface in no group
- A newly created group
Default deny, both directions. Every packet is dropped except the
platform’s own always-on allows. Attaching no security group is not the
permissive option — it is the closed one.
Rules
- Console
- API
- CLI
- Go
Go to Networking → Security Groups — Create Security Group makes
one, with a Name and an optional Description — then open it and
choose Add inbound rule or Add outbound rule. Which button you
pressed is the rule’s direction; there is no direction field in the
dialog, and the block where you name the other end is headed Source
or Destination to match.Pick a Service preset — HTTPS (443), SSH (22),
PostgreSQL (5432) and so on — or leave it on Custom and set IP
Version, Protocol and Port Range yourself. Port Range is one
field taking either a single port or a range, where the API takes
port_min and port_max separately. Then choose CIDR or Security
Group for the source, and confirm with Add Rule.The group’s Inbound and Outbound tabs list what it holds, each row
with a Delete rule action.security_group_id. In read responses,
source_security_group is a resource reference with id, crn, and an optional
name; create requests accept it as a string selector.
ingress | egress
required
For an
egress rule, remote_cidr and source_security_group name the
destination. The field names do not change with the direction.tcp | udp | icmp | all
required
ipv4 | ipv6
Defaults to
ipv4. A rule matches one family only; write two rules for both.integer
Required for
tcp and udp, and rejected without them. Ignored — and
cleared — for icmp and all. The range must satisfy
0 ≤ port_min ≤ port_max ≤ 65535. For a single port, set both to it.string | ResourceRef
required
Exactly one of the two is required. They are mutually exclusive, and
omitting both is rejected — there is no “any source” shorthand; write
0.0.0.0/0 or ::/0 explicitly. remote_cidr must match the rule’s
ethertype.Naming another group as the source
- Console
- API
- CLI
- Go
In Add inbound rule, switch the Source block from CIDR to
Security Group, then Pick a source security group.
Stateful
An allowed connection’s return traffic is allowed automatically. You do not write a mirrored rule in the opposite direction — an ingress rule for TCP 443 already lets the responses out.Attaching groups to an interface
Membership belongs to the interface, not to the group. There is nothing on a security group’s own page that attaches it to anything.- Console
- API
Open the interface under Networking → Interfaces. Its Security groups tab lists the full attached resources. Choose Attach security group to add one, or the row’s Detach security group action to remove one. Other attachments stay unchanged.
security_groups with the same resource fields as the top-level security-group list, plus meta. POST accepts one security_group string selector and returns {security_group}. DELETE takes the group’s UUID and returns 204. Removing the last group leaves the interface dropping all traffic.
Every id has to be a group your account owns. When several groups apply to one
interface, their allow rules are unioned — an interface is at least as open
as its most permissive group. You cannot subtract with a security group; to
narrow an interface, remove the group that allows the traffic.
Deleting a group is refused while any interface still belongs to it. Empty the
membership on each interface first. name is immutable; description and
tags can be patched.
What the platform enforces regardless
A small band of rules sits above yours. You cannot override or remove them through this API.Always allowed
DHCP, IPv6 neighbor discovery, and the link-local metadata endpoint at169.254.169.254. Every instance needs these to lease its address and to reach
instance metadata at boot, so they survive a default-deny posture — otherwise a
correctly-locked-down instance could never finish booting.
Always blocked: outbound TCP 25 to the internet
Direct-to-MX SMTP from a compromised or rented instance is the fastest way for an address range to land on a spam blocklist, and the cost of that lands on everyone sharing the range. The envelope carries your address, so the block is on port 25 specifically.The submission ports 465, 587 and 2525 are not blocked. Mail handed to an
authenticated provider leaves from that provider’s addresses carrying that
provider’s reputation, so blocking those buys nothing and breaks a great deal
of software that only speaks SMTP.The port 25 drop also excludes private destinations, so your own mail server
inside the VPC stays reachable from another instance.
Next
Interfaces
What a NIC is and how it gets its security groups.
Routing
Security groups decide the last hop. Routing decides whether the packet
ever arrives.