The security group is the firewall that will protect instances.
It manages network access permissions using a system of rules.
The default security group denies all incoming traffic and allows only outgoing traffic to your instance.
The rules of a security group are not fixed and can be modified at any time: by deleting or adding new rules.
Security groups can be used separately or by adding them.
You can list the existing groups in the project with openstack security group list.
$ openstack security group list
+--------------------------------------+-----------------+------------------------+----------------------------------+------+
| ID | Name | Description | Project | Tags |
+--------------------------------------+-----------------+------------------------+----------------------------------+------+
| 2d9d1210-78f9-47e4-87a5-68851cc9f5ec | nbgrader | | 88ddbfbb9b7f4fe981ce214be524d401 | [] |
| ea78016d-725c-4e7a-9a80-8f9ab3dd0db2 | default | Default security group | 88ddbfbb9b7f4fe981ce214be524d401 | [] |
| ee67a987-6e4e-4228-baac-0c5541e62631 | jupyterhub-test | | 88ddbfbb9b7f4fe981ce214be524d401 | [] |
+--------------------------------------+-----------------+------------------------+----------------------------------+------+
It is also possible to see in detail the rules defined in a security group by using openstack security group rule list <groupname>.
$ openstack security group rule list my-security-group
+--------------------------------------+-------------+-----------+------------+-----------------------+
| ID | IP Protocol | IP Range | Port Range | Remote Security Group |
+--------------------------------------+-------------+-----------+------------+-----------------------+
| 01e07f78-264d-478c-b100-fed022cc72ed | None | None | | None |
| 22d0ff13-360b-4fbb-8a3a-82d3235cfe34 | tcp | 0.0.0.0/0 | 22:22 | None |
| 45d6f8d3-ebca-485b-973f-62586c6859fc | None | None | | None |
| ac5211e7-62c3-4e6c-af02-d09a60878f99 | tcp | 0.0.0.0/0 | 80:80 | None |
| fd0fc114-421a-4686-8ae2-2ca44fcdfdfd | tcp | 0.0.0.0/0 | 443:443 | None |
+--------------------------------------+-------------+-----------+------------+-----------------------+
The creation of a new group is done using the openstack security group create <groupname> command, indicating the name of the security group.
For example: to create a group called my-security-group.
$ openstack security group create my-security-group
When it is created, the new group has no specific filtering rules.
So, you must add them according to your access needs to the instance.
The openstack security group rule list <groupname> command line lists every rules of a group.
You can add a new rule by using openstack security group rule create.
For example: we want to add a rule to allow ssh connection on instances.
In the first case, we only allow a given range of ip addresses:
$ openstack security group rule create my-security-group \
--remote-ip 152.77.223.66/32 \
--ingress \
--dst-port 22 \
--protocol tcp
In the second case, we allow access from IP addresses that coming from another security group (called other-security-group):
$ openstack security group rule create my-security-group \
--protocol tcp \
--dst-port 22 \
--remote-group other-security-group
Thanks to the filtering rules, we choose which protocols are authorized and which ports are open and available: the visibility of the instances with the world is limited.
In this part we give some examples of protocols and ports to open in order to authorize different connections.
Filters are applied to all ip addresses in the subnet: 0.0.0.0/0.
To connect to an instance by using ssh, the security group must authorize the TCP protocol and port 22 must be open.
$ openstack security group rule create my-security-group \
--protocol tcp \
--dst-port 22 \
--remote-ip 0.0.0.0/0
HTTP communication is only possible by authorizing the TCP protocol and opening port 80.
$ openstack security group rule create my-security-group \
--protocol tcp \
--dst-port 80 \
--remote-ip 0.0.0.0/0
The secure version of HTTP also communicates with the TCP protocol but using port 443.
$ openstack security group rule create my-security-group \
--protocol tcp \
--dst-port 443 \
--remote-ip 0.0.0.0/0
It is also possible to open a range of ports.
For example, NetBIOS uses ports 137-139.
$ openstack security group rule create my-security-group \
--protocol tcp \
--dst-port 137:139 \
--remote-ip 0.0.0.0/0
Please, see the full list of TCP ports for other types of TCP connection.
To authorize ping on instances, you must allow access to ICMP traffic:
$ openstack security group rule create my-security-group \
--protocol icmp \
You can remove a filtering rule by using:
$ openstack security group rule delete RULE_ID