Security groups

A security group is a set of inbound and outbound rules that control which traffic can reach attached resources.

In the console

Choose Networking, Security Groups.

To create a security group

  1. Choose Networking, Security Groups, then create a security group.
  2. For Name, enter a name.
  3. (Optional) Add inbound or outbound rules.
  4. Choose Save.

Wait until Status is Ready before relying on the rules.

Rules

Each rule includes:

Field Description
Description Optional label for the rule
Direction IN (inbound) or OUT (outbound)
Port Single port or range (for example, 3306 or 80-443)
Protocol tcp, udp, icmp, esp, or gre
Source / Destination CIDR (for example, 203.0.113.10/32), another security group, or an IP address set

To add a client access rule

  1. Open the security group and choose Edit.
  2. Choose Add inbound rule.
  3. Enter the port (for example, 3306 for MySQL, 5432 for PostgreSQL, or 6443 for Kubernetes API).
  4. Choose protocol tcp.
  5. For source, enter your client CIDR.
  6. Choose Save.
  7. Wait until Status is Ready.

Managed rules

Some rules are marked Managed. myStack creates these for service traffic (for example, database replication). You cannot edit or remove managed rules.

Note Databases and Kubernetes clusters often attach a managed security group automatically. Open client ports on that group instead of creating a separate group unless you need one.

To delete a security group

  1. Open the security group.
  2. Choose Delete.

Related