Skip to content

Create security group rules

Rules are added to existing security groups.

Security group rules

Security group rules can be defined for various protocols to control the flow of network traffic.

The default security rules are applied by default to new virtual machine instances. Default rules enable ether types ipv4 and ipv6 for any protocol on any port, for both ingress and egress traffic.

Default rules can be stacked with other rules (or disabled in conjunction with other rules).

Rule protocols

Protocol Use Case Properties
TCP Commonly used for web traffic (HTTP/HTTPS), email (SMTP, IMAP, POP3), and file transfer (FTP).
  • Port Range: Specifies the range of TCP ports to which the rule applies. For example, port 80 for HTTP or port 443 for HTTPS.
  • Source/Destination IP: Defines the IP address range for the source or destination of the traffic.
UDP Commonly used for streaming media (audio, video), online gaming, voice over IP (VoIP), and DNS queries.
  • Port Range: Specifies the range of UDP ports to which the rule applies. For example, port 53 for DNS or port 123 for NTP.
  • Source/Destination IP: Defines the IP address range for the source or destination of the traffic.
ICMP Commonly used for network troubleshooting tools like ping and traceroute, and for communicating network error messages. ICMP Type and Code: Specifies the ICMP message type and code, which determine the specific purpose of the message. For example, type 8 and code 0 for an echo request (ping).

Rule sources

You can specify the rule source as one of the following.

  • All traffic: to allow all IP addresses | Use to allow all traffic
  • CIDR: to specify a range of IP addresses using a standard notation | Use to limit your traffic range
  • Security group: to specify an existing security group | Use for standardized and centralized re-usable rules

Rule directions

  • Ingress: for inbound traffic
  • Egress: for outbound traffic

Ether type

Specifies the version of Internet Protocol to use. Ether type determines the format of the IP addresses and CIDR ranges that can be used in the rule. Use the correct IP version and format to ensure that the rule is applied correctly and provides the desired network access control. IPv6 is the latest protocol offering improvements in speed and greater availability of addresses.

  • IPv4: 32-bit address format
  • IPv6: 128-bit address format

Rules options

In addition to common protocols, you can define custom protocols or use one of pre-defined rule options that provide common default values for protocol properties.

Rule option Description
Custom TCP Rule Specify all properties for TCP rule setup
Custom UDP Rule Specify all properties for UDP rule setup
Custom ICMP Rule Specify all properties for ICMP rule setup
All Proto Enable all traffic for all available protocols, specify direction and ether type
All TCP Enable all traffic for TCP, specify direction and ether type
All UDP Enable all traffic for UDP, specify direction and ether type
All ICMP Enable all traffic for ICMP, specify direction and ether type
SSH Enables TCP on port 22
SMTP Enables TCP on port 25
SMTPS Enables TCP on port 465
HTTP Enables TCP on port 80
HTTPS Enables TCP with SSL encryption on port 443
DNS Enables TCP and UDP on port 53
POP3 Enables TCP on port 110
POP3S Enables TCP with SSL encryption on port 995
IMAP Enables TCP on port 143
IMAPS Enables TCP with on port 993
LDAP Enables TCP port 389
MS SQL Enables TCP on port 1433
MySQL Enables TCP on port 3306
RDP Enables TCP on port 3389
Other Protocol Specify protocols and properties

Instructions

  1. Go to Network > Security Groups to view the Security Groups console.
  2. Find a security group and select More > Create Rule. You can also create rules from the security groups details page.
  3. Select Create Rule.
  4. Select the protocol.
  5. Depending upon your protocol selection, you'll have additional properties to specify.
  6. Specify the direction to which to apply the rules. You can specify Ingress for incoming traffic into your network, or Egress for outgoing traffic exiting your network.
  7. Select OK to create the rule.

See also