Managed security groups using the CLI
This chapter shows guides you through the daily operations regarding security groups in stepping stone AG's OpenStack based cloud.
Note: This guide assumes that you already have access to the OpenStack CLI and are authenticated. If you are not, follow the OpenStack quick start guide.
Managed security groups using the CLI - Create group
A new security group may be created as follows:
project_id='' # Provide a OpenStack project id (such as 'ecd2fbce789f4e70bb31613e4e189a43')
secgroup_name='' # Give it a descriptive name (such as 'HTTPS World')
secgroup_description='' # Describe the security group further.
openstack security group create \
--project "${project_id}" \
--format value \
--column id \
--description "${secgroup_description}" \
"${secgroup_name}"
Upon successful creation the OpenStack CLI will simply return the id of the newly created security group:
5008898e-6307-499a-9d32-470e551d387a
Managed security groups using the CLI - Create rules
Upon creation, a new security group is empty and does not contain any rules.
To create a rule and assign it to the security group, continue as follows:
project_id='' # Provide a OpenStack project id (such as 'ecd2fbce789f4e70bb31613e4e189a43')
secgroup_id='' # Provide the UUID of the newly created security group (such as '5008898e-6307-499a-9d32-470e551d387a')
openstack security group rule create \
--project ${project_id} \
--ingress \
--ethertype IPv4 \
--protocol tcp \
--dst-port 443 \
--remote-ip "0.0.0.0/0" \
${secgroup_id}
The following paramters may be modified to further suit your situation:
- ingress: The rule may be either a
ingressor anegressrule. - ethertype: May be either
IPv4orIPv6. - protocol: May be either
tcporudp. - dst-port: May be any port between
0and65535. - remote-ip: May be an ip range such as
192.168.1.0/24or a single ip such as192.168.1.100/32. To allow traffic from anywhere, use0.0.0.0/0.
Upon successful creation, the OpenStack CLI should return an output similar to this:
+-------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
+-------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| created_at | 2026-10-28T14:15:12Z |
| description | |
| direction | ingress |
| ether_type | IPv4 |
| id | 2b2c8a6b-6110-4eee-9802-480f1ec12e20 |
| location | Munch({'cloud': '', 'region_name': 'duedingen-test', 'zone': None, 'project': Munch({'id': 'c2ebdf6ceea9464ea07922ebf8d2f857', 'name': None, 'domain_id': 'default', 'domain_name': None})}) |
| name | None |
| port_range_max | 443 |
| port_range_min | 443 |
| project_id | ecd2fbce789f4e70bb31613e4e189a43 |
| protocol | tcp |
| remote_group_id | None |
| remote_ip_prefix | 0.0.0.0/0 |
| revision_number | 0 |
| security_group_id | 5008898e-6307-499a-9d32-470e551d387a |
| tags | [] |
| updated_at | 2026-10-28T14:15:12Z |
+-------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+