Create and manage security groups and rules

This tutorial guides you through the process of creating/deleting or changing security groups in the STACKIT Portal.

Introduction

Security groups at STACKIT correspond to individual host firewalls to protect your server instances. These security groups can be reused for multiple systems. Changes to the security groups affect all assigned servers at the same time.

The standard set of rules (“default”) stipulates that all outgoing traffic is allowed and all incoming traffic is forbidden (traffic from systems in the same security group is an exception to the ban on incoming traffic). This means that inbound traffic must always be explicitly allowed before it is effectively allowed. This avoids external access being possible due to forgotten setting of security groups.

Create a security group

STACKIT Portal

1. On the pane on the left click on Security Groups. You can find it in the Networking section.

2. Click on Create security group.

3. A new pane opens. Fill in a Group name and optionally a Group description.

4. Click on Create.

Create a security rule

STACKIT Portal

1. On the pane on the left click on Security Groups. You can find it in the Networking section.

2. Click on the security group you want to create a security rule for. A new pane on the right hand side appears.

3. On the pane on the right click on Create security rule.

4. On the new pane configure your security rule:

   Description

   Fill in a meaningful description of your new security rule.

   Protocol

   Select a protocol on which the security rule should apply from the dropdown.

   Direction

   Select a direction. The underlying firewall acts stateful - thus replys within a connection are also captured of the opposite direction rule.

   IP range and any Source

   Enter a IPv4 or IPv6 range. With security rules you define only the source ip range. The destination IPs are automatically determined when applying the underlying security group to a resource. Use the CIDR notation. If you want a rule that applies to any source (0.0.0.0/0), check the Any Source select.

   Start port and end port

   Enter a start and an end port for your security rule. Security rules are allow rules by design. You can not create deny rules. Per default all traffic is denied. With security rules you only define the traffic, that will be allowed.

5. Click on Create to create your security rule.

Delete a security group

STACKIT Portal

1. Remove the security group from all resources. It is not possible to delete a security group with attached resources!

2. On the pane on the left click on Security Groups. You can find it in the Networking section.

3. Click on Delete in the three dots menu of the security group you want to delete.

4. On the new pane delete the security group by clicking on Delete.

Delete a security rule

STACKIT Portal

1. On the pane on the left click on Security Groups. You can find it in the Networking section.

2. Click on the security group you want to delete a security rule for. A new pane on the right hand side appears.

3. Navigate to the security rule you want to delete and on the three dots menu click on Delete.

4. A new pane opens. Click on Delete to finally delete your security rule.