Network Security Groups

Overview

Security groups are stateful, per-port firewall rulesets enforced at the hypervisor level. Every instance begins with a default security group that blocks all inbound traffic. Add rules to permit the specific protocols your workload requires — changes take effect immediately without a restart or interface bounce.

Prerequisites

An active Polystack project with at least one running instance
Dashboard access or CLI configured with valid credentials

Create a Security Group

Dashboard
CLI

Navigate to Security Groups

Navigate to Network > Security Groups. Click Create Security Group.

Name the group

Field	Description
Name	Short, descriptive name, e.g., `web-sg`
Description	Optional — e.g., “HTTP/HTTPS for web tier”

Each new security group automatically includes two egress rules that allow all outbound IPv4 and IPv6 traffic. Add ingress rules for the specific ports your workload exposes.

Add ingress rules

Click the security group name to open the detail page, then click Add Rule.The Add Rule form has these fields:

Field	Type	Required	Options
Direction	Radio	Yes	Ingress, Egress
Ether Type	Radio	Yes	IPv4, IPv6
Protocol	Dropdown	Yes	TCP, UDP, ICMP, ANY
Port Range Min	Number	Conditional	Shown for TCP/UDP only
Port Range Max	Number	Conditional	Shown for TCP/UDP only
Remote IP Prefix	Text	No	CIDR notation (e.g., `0.0.0.0/0`)
Description	Text area	No	Rule description

Common rules to add:

Direction	Protocol	Port Range	Remote	Purpose
Ingress	TCP	80	0.0.0.0/0	HTTP
Ingress	TCP	443	0.0.0.0/0	HTTPS
Ingress	TCP	22	`<your-office-CIDR>`	SSH management
Ingress	ICMP	Any	0.0.0.0/0	Ping and diagnostics

Avoid rules with remote 0.0.0.0/0 for SSH (port 22) in production. Restrict to your management CIDR or route SSH through a bastion host.

Assign to an instance

Navigate to Compute > Instances, click the More dropdown on the instance row, then select Manage Security Group under Related Resources. Select a port and add web-sg to the assigned security groups.

The rule takes effect immediately — no restart required.

Authenticate

Source your credentials file to authenticate with the Polystack platform:

Load credentials

source openrc.sh

Your administrator provides the RC (credentials) file for your project. See CLI Setup for configuration details.

Create the security group

Create security group

openstack security group create web-sg \
  --description "HTTP/HTTPS for web tier"

Add ingress rules

Allow HTTP

openstack security group rule create web-sg \
  --protocol tcp --dst-port 80 --ingress --remote-ip 0.0.0.0/0

Allow HTTPS

openstack security group rule create web-sg \
  --protocol tcp --dst-port 443 --ingress --remote-ip 0.0.0.0/0

Allow SSH from management network

openstack security group rule create web-sg \
  --protocol tcp --dst-port 22 --ingress --remote-ip 10.0.0.0/8

Allow ICMP

openstack security group rule create web-sg \
  --protocol icmp --ingress --remote-ip 0.0.0.0/0

Assign to an instance

Add security group to instance

openstack server add security group my-instance web-sg

Rules apply immediately without a reboot or interface restart.

Common Rules Reference

Use Case	Direction	Protocol	Port	Remote
HTTP web traffic	Ingress	TCP	80	0.0.0.0/0
HTTPS web traffic	Ingress	TCP	443	0.0.0.0/0
SSH access	Ingress	TCP	22	Management CIDR
ICMP ping	Ingress	ICMP	Any	0.0.0.0/0
MySQL / MariaDB	Ingress	TCP	3306	App tier CIDR
PostgreSQL	Ingress	TCP	5432	App tier CIDR
Redis	Ingress	TCP	6379	App tier CIDR
Custom UDP service	Ingress	UDP	1194	0.0.0.0/0
All outbound	Egress	Any	Any	0.0.0.0/0

Source Security Group Rules

Rules can reference another security group as the remote source instead of a CIDR. This allows traffic from any instance assigned the referenced group, regardless of IP.

Allow traffic from app tier security group

openstack security group rule create db-sg \
  --protocol tcp \
  --dst-port 5432 \
  --ingress \
  --remote-group app-sg

Security group references are more maintainable than CIDR-based rules in dynamic environments — you add or remove instances from the source group rather than updating IP ranges in rules.

Manage Rules and Groups

Remove a Rule

List rules in a group

openstack security group rule list web-sg

Delete a specific rule

openstack security group rule delete <rule-id>

Remove a Security Group from an Instance

Remove security group from instance

openstack server remove security group my-instance web-sg

Delete a Security Group

Delete security group

openstack security group delete web-sg

Deleting a security group that is still assigned to instances will fail. Remove all instance assignments before deleting the group.

Next Steps

Floating IP Addresses

Associate public IPs with instances — ensure your security group allows inbound traffic first

Security Hardening

Administrator guide for port security, anti-spoofing, and default group hardening

Network Troubleshooting

Diagnose security group and connectivity issues

Create a Network

Set up the network your secured instances attach to

Core Services

Other Services

Overview

Create a Security Group

Navigate to Security Groups

Name the group

Add ingress rules

Assign to an instance

Authenticate

Create the security group

Add ingress rules

Assign to an instance

Common Rules Reference

Source Security Group Rules

Manage Rules and Groups

Remove a Rule

Remove a Security Group from an Instance

Delete a Security Group

Next Steps

Floating IP Addresses

Security Hardening

Network Troubleshooting

Create a Network

​Overview

​Create a Security Group

Navigate to Security Groups

Name the group

Add ingress rules

Assign to an instance

Authenticate

Create the security group

Add ingress rules

Assign to an instance

​Common Rules Reference

​Source Security Group Rules

​Manage Rules and Groups

​Remove a Rule

​Remove a Security Group from an Instance

​Delete a Security Group

​Next Steps

Floating IP Addresses

Security Hardening

Network Troubleshooting

Create a Network

Overview

Create a Security Group

Common Rules Reference

Source Security Group Rules

Manage Rules and Groups

Remove a Rule

Remove a Security Group from an Instance

Delete a Security Group

Next Steps