Skip to main content
Last updated on

Security Group

A Security Group is a set of firewall rules attached to a VM (or a Network Interface) to control traffic. Properties:

  • Stateful — replies to allowed connections pass through automatically; no return-rule needed.
  • Default deny on Ingress — only traffic matching a rule is allowed in.
  • Default allow on Egress in the default Security Group — VMs can call out freely.
  • Additive when multiple SGs are attached — rules across all SGs are OR-combined.

Create a Security Group​

Step 1. Open the Security Group page​

Go to Network → Security Group and click + Create Security Group.

Security Group page with the Create button

Step 2. Name and describe​

Name by role (web-public, db-private, bastion-only…). Unlike a Network, Description is required when creating a Security Group — it can't be left blank.

Create Security Group form

The new Security Group ships with 2 default Egress rules (one for IPv4, one for IPv6 — allow everything outbound) — you only need to add Ingress rules for the ports you want to open.

Add a rule to a Security Group​

Step 1. Open the rule management page​

In the list, click the manage rules icon (⚙) next to the Security Group.

Security Group list

Step 2. Create a rule​

Click + Create rule.

SG detail page with the Create rule button

Step 3. Pick a Rule preset​

The Rule field is a list of built-in presets — picking the right one auto-fills Protocol/Direction/Port for common services, no need to look up port numbers yourself:

RuleProtocolDirection / Port
Custom TCP (default)TCPPick Direction + Port yourself
Custom UDPUDPPick Direction + Port yourself
All TCPTCPPick Direction, applies to every port
All UDPUDPPick Direction, applies to every port
SSHTCPIngress, port 22 (fixed)
HTTPTCPIngress, port 80 (fixed)
HTTPSTCPIngress, port 443 (fixed)
MySQLTCPIngress, port 3306 (fixed)
RDPTCPIngress, port 3389 (fixed)
IMAPTCPIngress, port 143 (fixed)
POP3TCPIngress, port 110 (fixed)
DNSTCPIngress, port 53 (fixed)
ICMPICMPPick Direction yourself

Only Custom TCP/UDP show a Port field — and it takes a single port, not a range, even though the rule table's column is labeled "Port range". To open a contiguous range of ports, create separate rules for each, or use All TCP/All UDP to open every port for that protocol.

Step 4. Configure the Remote​

FieldMeaningExample
Description (optional)NoteSSH from office
RemoteCIDR or Security GroupCIDR
CIDRSource/destination IP range — only shown when Remote = CIDR0.0.0.0/0 or 203.0.113.10/32
Security groupAllow traffic from VMs in another SG — only shown when Remote = Security Groupsg-app-tier
IP versionIPv4 or IPv6 — only selectable when Remote = Security Group; when Remote = CIDR, the portal always applies IPv4IPv4

Click Lưu (Save).

Rule form with the fields

Step 5. Verify the rule​

The new rule shows up in the table (the Loại / Type column shows IPv4/IPv6) and applies immediately to every VM that has this SG attached.

Rules list in a Security Group

Common rule sets​

Public web server​

DirectionProtocolPortRemotePurpose
IngressTCP800.0.0.0/0HTTP
IngressTCP4430.0.0.0/0HTTPS
IngressTCP22<office-IP>/32SSH from the office only

Internal database​

DirectionProtocolPortRemotePurpose
IngressTCP3306sg-app-tierMySQL only from app servers
IngressTCP22sg-bastionSSH only through the bastion

There is no rule opening 3306 to 0.0.0.0/0 — the database is never exposed to the Internet.

Bastion / jump host​

DirectionProtocolPortRemotePurpose
IngressTCP22<office-IP>/32SSH from the office only

Internal VMs then only accept SSH from sg-bastion.

Security recommendations​

  • Never open 0.0.0.0/0 for admin ports (SSH 22, RDP 3389, DB 3306/5432, …) — restrict to specific IPs.
  • Split Security Groups by tier (web / app / db) — don't dump every rule into a single SG.
  • Use a Security Group as the Remote instead of a CIDR for internal traffic — auto-updates when VM IPs change.
  • Audit regularly and remove rules you no longer use to shrink the attack surface.
Rule changes apply immediately

Adding or removing a rule takes effect right away for every VM with the SG attached. Before removing a rule for an admin port (SSH/RDP), make sure you have an alternative channel (Portal Console, another SG covering that port) so you don't lock yourself out.

See also​