Security group rules

Overview

This page describes the handling of security groups within OpenStack.

Managed security groups using the CLI

This chapter shows guides you through the daily operations regarding security groups in stepping stone AG's OpenStack based cloud.

Note: This guide assumes that you already have access to the OpenStack CLI and are authenticated. If you are not, follow the OpenStack quick start guide.

Managed security groups using the CLI - Create group

A new security group may be created as follows:

project_id=''              # Provide a OpenStack project id (such as 'ecd2fbce789f4e70bb31613e4e189a43')
secgroup_name=''           # Give it a descriptive name (such as 'HTTPS World')
secgroup_description=''    # Describe the security group further.

openstack security group create \
      --project "${project_id}" \
      --format value \
      --column id \
      --description "${secgroup_description}" \
      "${secgroup_name}"

Upon successful creation the OpenStack CLI will simply return the id of the newly created security group:

5008898e-6307-499a-9d32-470e551d387a

Managed security groups using the CLI - Create rules

Upon creation, a new security group is empty and does not contain any rules.

To create a rule and assign it to the security group, continue as follows:

project_id=''              # Provide a OpenStack project id (such as 'ecd2fbce789f4e70bb31613e4e189a43')
secgroup_id=''             # Provide the UUID of the newly created security group (such as '5008898e-6307-499a-9d32-470e551d387a')

openstack security group rule create \
    --project ${project_id} \
    --ingress \
    --ethertype IPv4 \
    --protocol tcp \
    --dst-port 443 \
    --remote-ip "0.0.0.0/0" \
    ${secgroup_id}

The following paramters may be modified to further suit your situation:

• ingress: The rule may be either a ingress or an egress rule.
• ethertype: May be either IPv4 or IPv6.
• protocol: May be either tcp or udp.
• dst-port: May be any port between 0 and 65535.
• remote-ip: May be an ip range such as 192.168.1.0/24 or a single ip such as 192.168.1.100/32. To allow traffic from anywhere, use 0.0.0.0/0.

Upon successful creation, the OpenStack CLI should return an output similar to this:

+-------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field             | Value                                                                                                                                                                                        |
+-------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| created_at        | 2026-10-28T14:15:12Z                                                                                                                                                                         |
| description       |                                                                                                                                                                                              |
| direction         | ingress                                                                                                                                                                                      |
| ether_type        | IPv4                                                                                                                                                                                         |
| id                | 2b2c8a6b-6110-4eee-9802-480f1ec12e20                                                                                                                                                         |
| location          | Munch({'cloud': '', 'region_name': 'duedingen-test', 'zone': None, 'project': Munch({'id': 'c2ebdf6ceea9464ea07922ebf8d2f857', 'name': None, 'domain_id': 'default', 'domain_name': None})}) |
| name              | None                                                                                                                                                                                         |
| port_range_max    | 443                                                                                                                                                                                          |
| port_range_min    | 443                                                                                                                                                                                          |
| project_id        | ecd2fbce789f4e70bb31613e4e189a43                                                                                                                                                             |
| protocol          | tcp                                                                                                                                                                                          |
| remote_group_id   | None                                                                                                                                                                                         |
| remote_ip_prefix  | 0.0.0.0/0                                                                                                                                                                                    |
| revision_number   | 0                                                                                                                                                                                            |
| security_group_id | 5008898e-6307-499a-9d32-470e551d387a                                                                                                                                                         |
| tags              | []                                                                                                                                                                                           |
| updated_at        | 2026-10-28T14:15:12Z                                                                                                                                                                         |
+-------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

Managed security groups using the CLI - Assign to server

To assign a security group to a server, follow the provided steps:

server_id=''            # Provide the UUID of a server (Such as 'ddad0639-013e-4ec1-b06e-846de3126b81')
secgroup_id=''          # Provide the UUID of a security group (such as '5008898e-6307-499a-9d32-470e551d387a')

openstack server add security group ${server_id} ${secgroup_id}

Upon successful assignment, the OpenStack CLI returns an empty response and the return code 0.

Managed security groups using the CLI - List

To list all security groups, follow the provided steps:

openstack security group list

This will return an output similar to this:

+--------------------------------------+----------------------------------------------------------------------------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------+----------------------------------+------+
| ID                                   | Name                                                                                                                 | Description                                                                                                                     | Project                          | Tags |
+--------------------------------------+----------------------------------------------------------------------------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------+----------------------------------+------+
| fca535cd-9b5a-451f-b09b-0a336bbd4787 | Security Group 1                                                                                                     | Do some stuff in security group 1.                                                                                              | 6a7408fea29a4412b8fb62e32e0e9535 | []   |
| e6e73ec5-97a3-4742-956c-6cbefd2c0b9c | Security Group 2                                                                                                     | Do some stuff in security group 2.                                                                                              | 6a7408fea29a4412b8fb62e32e0e9535 | []   |
[...]

Beware: This will list all the security groups of all the projects you have access to.

To list all security groups only for a certain project, follow the provided steps:

project_id=''            # Provide the UUID of a project (Such as 'ddad0639013e4ec1b06e846de3126b81') 

openstack security group list --project ${project_id}

Managed security groups using the CLI - Show

To show all the available data for a security group, follow the provided steps:

secgroup_id=''            # Provide the UUID of a security group (Such as 'fca535cd-9b5a-451f-b09b-0a336bbd4787') 

openstack security group show ${secgroup_id}

The returned output should be similar to this:

+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field           | Value                                                                                                                                                                                                                                                                                                                      |
+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| created_at      | 2022-12-07T16:02:48Z                                                                                                                                                                                                                                                                                                       |
| description     | Allow TFTP traffic from 0.0.0.0/0 on UDP port 69.                                                                                                                                                                                                                                                                          |
| id              | fca535cd-9b5a-451f-b09b-0a336bbd4787                                                                                                                                                                                                                                                                                       |
| location        | cloud='', project.domain_id='default', project.domain_name=, project.id='ddad0639013e4ec1b06e846de3126b81', project.name=, region_name='duedingen-production', zone=                                                                                                                                                       |
| name            | TFTP World                                                                                                                                                                                                                                                                                                                 |
| project_id      | ddad0639013e4ec1b06e846de3126b81                                                                                                                                                                                                                                                                                           |
| revision_number | 6                                                                                                                                                                                                                                                                                                                          |
| rules           | created_at='2022-12-08T10:34:08Z', direction='ingress', ethertype='IPv4', id='89c46a1c-9651-46b2-98e1-fc3412e8c36b', normalized_cidr='0.0.0.0/0', port_range_max='69', port_range_min='69', protocol='udp', remote_ip_prefix='0.0.0.0/0', revision_number='1', standard_attr_id='49999', updated_at='2022-12-08T10:34:08Z' |
| tags            | []                                                                                                                                                                                                                                                                                                                         |
| updated_at      | 2022-12-08T10:34:08Z                                                                                                                                                                                                                                                                                                       |
+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

Managed security groups using the CLI - Delete

To delete a security group using the OpenStack CLI, the following steps may be consulted:

secgroup_id=''

openstack security group delete ${secgroup_id}

Upon successful deletion the OpenStack CLI will return an empty response and the status code 0.

Managed security groups using the Dashboard

This chapter shows guides you through the daily operations regarding security groups in stepping stone AG's OpenStack based cloud.

Note: This guide assumes that you already have access to the OpenStack Dashboard and are authenticated. If you are not, follow the OpenStack quick start guide.

Managing security groups using the Dashboard - Create group

A new security group can be created as follows:

In the list at the top, select the project for which you want to create a new security group.

Then, in the left menu, choose Project → Network → Security Groups.

Now enter a Name and a Description for your security group, then click Create Security Group.

You will then be redirected to the newly created security group, which shows its OpenStack UUID and the default security rules. If you do not need the default rules, follow the instructions in the last section of this manual: Managing security groups using the Dashboard - Delete.

Managing security groups using the Dashboard - Create rules

To add a new rule to a security group:

In the left menu, choose Project → Network → Security Groups.

Next to the security group you want to add a rule to, click Manage Rules on the right.

On the page that opens, click + Add Rule and fill out the form with the values for the new rule.

The following parameters can be adjusted to suit your needs:

• Rule: Select a predefined rule for a protocol, or create a custom rule. If you select a predefined rule, you only need to fill out the following fields: Description, Remote and CIDR.
• Description: An optional description of the rule.
• Direction: The rule can be either an Ingress or an Egress rule.
• Open Port: Choose whether to open a single Port, a Port Range or All ports.
  • Port: Any port between 0 and 65535.
  • Port Range: Enter a From Port and a To Port. Both must be between 0 and 65535.
  • All ports: All ports are opened.
• Remote: Specify the source of the traffic allowed by this rule. This can be either a CIDR or a Security Group.
  • CIDR: Allows traffic from an IP address range.
    • CIDR: An IP range such as 192.168.1.0/24 or a single IP address such as 192.168.1.100/32. To allow traffic from anywhere, use 0.0.0.0/0.
  • Security Group: Allows traffic from instances that belong to the selected security group.
    • Security Group: Select the security group whose instances are allowed to send traffic.
    • Ether Type: Either IPv4 or IPv6.

Managing security groups using the Dashboard - Assign to server

To assign a security group to an instance:

In the left menu, choose Project → Compute → Instances.

Next to the instance you want to assign the security group to, click the drop-down menu in the Actions column on the right and select Edit Security Groups.

A pop-up window opens. On the left, it shows a list of All Security Groups; on the right, it shows the Instance Security Groups.

To assign a security group to the instance, click + next to it in the list on the left. To remove a security group from the instance, click - next to it in the list on the right.

Managed security groups using the Dashboard - List

In the OpenStack Dashboard, you can list the security groups of a project. However, you cannot list the security groups of all projects at once. To do this, use the CLI as described in Managing security groups using the CLI.

To list the security groups of a project:

In the list at the top, select the project.

In the left menu, choose Project → Network → Security Groups.

Managing security groups using the Dashboard - Show

To view the properties of a security group:

In the left menu, choose Project → Network → Security Groups.

Next to the security group you want to view, click Manage Rules on the right.

This page shows the OpenStack UUID of the security group and its rules.

Managed security groups using the Dashboard - Delete

In order to delete a security group:

In the left menu, choose Project → Network → Security Groups.

Next to the security group you want to delete, click the drop-down menu in the Actions column on the right and select Delete Security Group.

Alternatively, select the checkboxes on the left of the security groups you want to delete, then click the red Delete Security Groups button.