About security group rules

A security group contains rules that can be added or removed at any time.

These rules control access to the VM (Virtual Machine) with which the security group is associated. They define which inbound traffic is authorized to reach the VM, and which outbound traffic is authorized to leave them.

General information

The rules of a security group cannot explicitly deny access. Access is denied by default unless a security group rule explicitly authorizes it.

When you modify the rules of a security group, these changes are automatically and immediately applied to all the VM with which this security group is associated.

Security groups are stateful, which means that responses to authorized traffic are also authorized. Thus, the response traffic to requests sent from the VM is automatically authorized regardless of the rules for the inbound traffic of its security groups. In a VPC (Virtual Private Cloud), the response traffic to authorized inbound traffic is also automatically authorized regardless of the rules for the outbound traffic of the VM's security groups.

In the same way as we recommend using a VM for a single service only, we recommend creating one security group per service with the appropriate rules, and associating this security group with all the VM dedicated to that service. You can then authorize inbound and outbound traffic between your security groups according to the services that need to communicate with each other, in order to apply these rules to all the VM concerned.

Characteristics

When you create a security group rule, you must specify the following four elements:

• The direction of the traffic.

• The protocol of the traffic: TCP (Transmission Control Protocol), UDP (User Datagram Protocol), ICMP (Internet Control Message Protocol), or -1 for all protocols. In a VPC, this value can also be an IP (Internet Protocol) protocol number. To find out more, see the IANA.org site.

• The port or the range of ports, between 1 and 65535 for the TCP and UDP protocols, or the ICMP type number. You can specify all ICMP types with -1.

  warning

  Avoid opening traffic on all ports (1-65535), as this prevents you from controlling it effectively. Open traffic only on the ports you need.

  In the Numspot console, you can select predefined services corresponding to specific combinations of traffic protocols and ports/ICMP numbers:

  Service	Protocol	Port
  SSH	TCP	22
  HTTP	TCP	80
  HTTPS	TCP	443
  DNS	UDP	53
  IMAP	TCP	143
  Secure IMAP	TCP	993
  POP3	TCP	110
  Secure POP3	TCP	995
  SMTP	TCP	25
  SMTPS	TCP	465
  LDAP	TCP	389
  MySQL	TCP	3306
  MS SQL	TCP	1433
  ICMP	ICMP	-1
  RDP	TCP	3389

• The target, that is to say one of the following options as the source of the inbound traffic or the destination of the outbound traffic:

  • An IP, in CIDR (Classless Inter-Domain Routing) notation. You can specify a public or private IP.

    tip

    As the public IP changes each time you stop and start your VM, security group rules relying on a public IP may become obsolete. To associate a public IP with your VM persistently, even when the VM is stopped and restarted, you can use a Numspot tag specifying a public IP.

  • A range of IP, in CIDR notation (for example 101.365.245.3/16).

    danger

    Using a /0 prefix opens the specified port or port range to everyone. We strongly advise against using it on the administration port — SSH (Secure Shell) port 22 for Linux, or RDP (Remote Desktop Protocol) port 3389 for Windows —, as this can expose your resources to attacks.

  • Another security group, to authorize the inbound or outbound traffic of all the VM with which this security group is associated:

    • If your security group is allocated to the public Cloud, you can reference a security group for the public Cloud that belongs to you or that belongs to another account.

    • If your security group is allocated to a VPC, you can reference a security group for the same VPC.

      tip

      To authorize communication between the VM associated with the same security group that you have created, you must add a rule that explicitly authorizes the inbound traffic coming from this security group.

      info

      By default, traffic between two security groups is authorized through both public IP and private IP. To restrict it to private IP only, contact our Support team.

  • (outbound traffic only) The ID of a prefix list to authorize traffic coming from VM placed in a VPC to access a service (for example, Numspot Object Storage).