Filtering access with “Security Groups”

Note

“Security Groups” in OpenStack are IP filters that can be applied to one or more instances to all the project instances.

A security group called default is created in each project and it applies to all project instances.

By default a number of standard rules, not visible to users, such as allowing ping and other rules specific to the DC network were added to facilitate some generic access.

Display help

% openstack help security group
Command "security" matches:
  security group create
  security group delete
  security group list
  security group rule create
  security group rule delete
  security group rule list
  security group rule show
  security group set
  security group show

Create a security group

% openstack security group create --description "My security group" <security group>

Add rules

Add a rule that allows SSH from a machine. Example of a machine with ip address 192.168.1.100:

% openstack security group rule create --remote-ip 192.168.1.100/32 --protocol tcp --dst-port 22 <security group>

Add a rule that allows SSH from a network. Example of 192.168.1.0/24 network:

% openstack security group rule create --remote-ip 192.168.1.0/24 --protocol tcp --dst-port 22 <security group>

List the security group rules

% openstack security group rule list --long <security group>
+--------------------------------------+-------------+-------------------+------------+-----------+-----------+-----------------------+
| ID                                   | IP Protocol | IP Range          | Port Range | Direction | Ethertype | Remote Security Group |
+--------------------------------------+-------------+-------------------+------------+-----------+-----------+-----------------------+
| 154b4191-c1e6-4d23-9bfa-6455b4fff87a | tcp         | 192.168.1.100/32  | 22:22      | ingress   | IPv4      | None                  |
| 3a5184cb-965c-4f0e-9e56-5738337709dc | None        | None              |            | egress    | IPv6      | None                  |
| d21613f1-7a0a-4357-a051-8ee705d596fe | None        | None              |            | egress    | IPv4      | None                  |
+--------------------------------------+-------------+-------------------+------------+-----------+-----------+-----------------------+

Add the security group to a VM

% openstack server add security group <VM name> <security group>

Delete a rule

% openstack security group rule delete 154b4191-c1e6-4d23-9bfa-6455b4fff87a

Important

It is possible to delete a rule but it is not possible to modify it.