Security group rules

Overview

This page describes the handling of security groups within OpenStack.

Managed security groups using the CLI

This chapter shows guides you through the daily operations regarding security groups in stepping stone AG's OpenStack based cloud.

Note: This guide assumes that you already have access to the OpenStack CLI and are authenticated. If you are not, follow the OpenStack quick start guide.

Managed security groups using the CLI - Create group

A new security group may be created as follows:

project_id=''              # Provide a OpenStack project id (such as 'ecd2fbce789f4e70bb31613e4e189a43')
secgroup_name=''           # Give it a descriptive name (such as 'HTTPS World')
secgroup_description=''    # Describe the security group further.

openstack security group create \
      --project "${project_id}" \
      --format value \
      --column id \
      --description "${secgroup_description}" \
      "${secgroup_name}"

Upon successful creation the OpenStack CLI will simply return the id of the newly created security group:

5008898e-6307-499a-9d32-470e551d387a

Managed security groups using the CLI - Create rules

Upon creation, a new security group is empty and does not contain any rules.

To create a rule and assign it to the security group, continue as follows:

project_id=''              # Provide a OpenStack project id (such as 'ecd2fbce789f4e70bb31613e4e189a43')
secgroup_id=''             # Provide the UUID of the newly created security group (such as '5008898e-6307-499a-9d32-470e551d387a')

openstack security group rule create \
    --project ${project_id} \
    --ingress \
    --ethertype IPv4 \
    --protocol tcp \
    --dst-port 443 \
    --remote-ip "0.0.0.0/0" \
    ${secgroup_id}

The following paramters may be modified to further suit your situation:

• ingress: The rule may be either a ingress or an egress rule.
• ethertype: May be either IPv4 or IPv6.
• protocol: May be either tcp or udp.
• dst-port: May be any port between 0 and 65535.
• remote-ip: May be an ip range such as 192.168.1.0/24 or a single ip such as 192.168.1.100/32. To allow traffic from anywhere, use 0.0.0.0/0.

Upon successful creation, the OpenStack CLI should return an output similar to this:

+-------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field             | Value                                                                                                                                                                                        |
+-------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| created_at        | 2026-10-28T14:15:12Z                                                                                                                                                                         |
| description       |                                                                                                                                                                                              |
| direction         | ingress                                                                                                                                                                                      |
| ether_type        | IPv4                                                                                                                                                                                         |
| id                | 2b2c8a6b-6110-4eee-9802-480f1ec12e20                                                                                                                                                         |
| location          | Munch({'cloud': '', 'region_name': 'duedingen-test', 'zone': None, 'project': Munch({'id': 'c2ebdf6ceea9464ea07922ebf8d2f857', 'name': None, 'domain_id': 'default', 'domain_name': None})}) |
| name              | None                                                                                                                                                                                         |
| port_range_max    | 443                                                                                                                                                                                          |
| port_range_min    | 443                                                                                                                                                                                          |
| project_id        | ecd2fbce789f4e70bb31613e4e189a43                                                                                                                                                             |
| protocol          | tcp                                                                                                                                                                                          |
| remote_group_id   | None                                                                                                                                                                                         |
| remote_ip_prefix  | 0.0.0.0/0                                                                                                                                                                                    |
| revision_number   | 0                                                                                                                                                                                            |
| security_group_id | 5008898e-6307-499a-9d32-470e551d387a                                                                                                                                                         |
| tags              | []                                                                                                                                                                                           |
| updated_at        | 2026-10-28T14:15:12Z                                                                                                                                                                         |
+-------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

Managed security groups using the CLI - Assign to server

To assign a security group to a server, follow the provided steps:

server_id=''            # Provide the UUID of a server (Such as 'ddad0639-013e-4ec1-b06e-846de3126b81')
secgroup_id=''          # Provide the UUID of a security group (such as '5008898e-6307-499a-9d32-470e551d387a')

openstack server add security group ${server_id} ${secgroup_id}

Upon successful assignment, the OpenStack CLI returns an empty response and the return code 0.

Managed security groups using the CLI - List

To list all security groups, follow the provided steps:

openstack security group list

This will return an output similar to this:

+--------------------------------------+----------------------------------------------------------------------------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------+----------------------------------+------+
| ID                                   | Name                                                                                                                 | Description                                                                                                                     | Project                          | Tags |
+--------------------------------------+----------------------------------------------------------------------------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------+----------------------------------+------+
| fca535cd-9b5a-451f-b09b-0a336bbd4787 | Security Group 1                                                                                                     | Do some stuff in security group 1.                                                                                              | 6a7408fea29a4412b8fb62e32e0e9535 | []   |
| e6e73ec5-97a3-4742-956c-6cbefd2c0b9c | Security Group 2                                                                                                     | Do some stuff in security group 2.                                                                                              | 6a7408fea29a4412b8fb62e32e0e9535 | []   |
[...]

Beware: This will list all the security groups of all the projects you have access to.

To list all security groups only for a certain project, follow the provided steps:

project_id=''            # Provide the UUID of a project (Such as 'ddad0639013e4ec1b06e846de3126b81') 

openstack security group list --project ${project_id}

Managed security groups using the CLI - Show

To show all the available data for a security group, follow the provided steps:

secgroup_id=''            # Provide the UUID of a security group (Such as 'fca535cd-9b5a-451f-b09b-0a336bbd4787') 

openstack security group show ${secgroup_id}

The returned output should be similar to this:

+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field           | Value                                                                                                                                                                                                                                                                                                                      |
+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| created_at      | 2022-12-07T16:02:48Z                                                                                                                                                                                                                                                                                                       |
| description     | Allow TFTP traffic from 0.0.0.0/0 on UDP port 69.                                                                                                                                                                                                                                                                          |
| id              | fca535cd-9b5a-451f-b09b-0a336bbd4787                                                                                                                                                                                                                                                                                       |
| location        | cloud='', project.domain_id='default', project.domain_name=, project.id='ddad0639013e4ec1b06e846de3126b81', project.name=, region_name='duedingen-production', zone=                                                                                                                                                       |
| name            | TFTP World                                                                                                                                                                                                                                                                                                                 |
| project_id      | ddad0639013e4ec1b06e846de3126b81                                                                                                                                                                                                                                                                                           |
| revision_number | 6                                                                                                                                                                                                                                                                                                                          |
| rules           | created_at='2022-12-08T10:34:08Z', direction='ingress', ethertype='IPv4', id='89c46a1c-9651-46b2-98e1-fc3412e8c36b', normalized_cidr='0.0.0.0/0', port_range_max='69', port_range_min='69', protocol='udp', remote_ip_prefix='0.0.0.0/0', revision_number='1', standard_attr_id='49999', updated_at='2022-12-08T10:34:08Z' |
| tags            | []                                                                                                                                                                                                                                                                                                                         |
| updated_at      | 2022-12-08T10:34:08Z                                                                                                                                                                                                                                                                                                       |
+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

Managed security groups using the CLI - Delete

To delete a security group using the OpenStack CLI, the following steps may be consulted:

secgroup_id=''

openstack security group delete ${secgroup_id}

Upon successful deletion the OpenStack CLI will return an empty response and the status code 0.

To be documented in the future.