Security groups

A security group is a set of stateful firewall rules that control inbound and outbound traffic to your resources. Security groups are tied to a VPC and can be reused across all resources in that VPC. You need at least one security group before creating an instance. By default, all traffic is denied — you must explicitly add rules to allow it.

​

Summary

This page explains how to create and manage security groups in the Nscale Console UI. Use this workflow if you:

• Need to control which traffic can reach your instances and clusters
• Want to define reusable firewall rules within a VPC
• Are setting up networking before creating instances (a security group is required)

​

Availability

This feature is available for On-demand and Reserved cloud services.

​

Requirements

• A VPC network to associate the security group with
• Permission and sufficient quota to create security groups

​

Key concepts

• Inbound rules control traffic coming into your resources (e.g., SSH connections from your IP)
• Outbound rules control traffic going out from your resources (e.g., internet access for package downloads)
• Stateful: If you allow an inbound connection, the return traffic is automatically allowed (and vice versa)

​

CIDR notation

Security group rules use CIDR notation to specify IP ranges:

​

Protocol reference

​

Common rule examples

​

Security group lifecycle

​

Step-by-step

​

Create a security group

1. In the Console, open your project, then go to Network → Security Groups
2. Click the + New button in the top-right corner
3. A side panel opens with the creation form:
   • Name: Enter a name for the security group
   • VPC: Select the VPC this security group will belong to
   • Description (optional): Add a description (up to 200 characters)
4. Click Add Rules to define your firewall rules:
   • Choose Inbound or Outbound
   • Select the Protocol (TCP, UDP, Any, or VRRP)
   • Enter the Port Range (e.g., 22 for SSH, 80 for HTTP, or 1-65535 for all ports)
   • Enter the CIDR block (e.g., 0.0.0.0/0 for all IPs)
   • Add as many rules as needed
5. Click Create to save the security group

​

View security group details

Click any security group in the list to view its detail page. The detail page has four tabs:

• Overview — summary of rules, linked instances, and configuration details (VPC, region, project)
• Rules — full table of inbound and outbound rules with add/edit side panels
• Instances — all instances using this security group, with search filtering
• Settings — rename the security group or delete it

​

Managing security groups

To edit rules on an existing security group:

1. Go to Network → Security Groups and select the security group
2. Open the Rules tab
3. Add, modify, or remove rules as needed
4. Save your changes

To rename a security group:

1. Open the security group detail page and go to the Settings tab
2. Edit the name and save

To delete a security group:

1. Ensure no resources are attached to it (check the Instances tab)
2. Go to the Settings tab and click Delete, or use the actions menu from the list page

​

Common issues / troubleshooting

• Symptom: Can’t delete a security group. Likely cause: The security group is attached to one or more active resources (instances, clusters). Fix: Remove or delete the associated resources, then try deleting the security group again.
• Symptom: Instance is unreachable via SSH. Likely cause: No inbound rule for SSH (TCP port 22) in the instance’s security group. Fix: Go to Network → Security Groups, select the security group attached to the instance, and add an inbound rule for TCP port 22 from your IP or 0.0.0.0/0.
• Symptom: Instance can’t download packages or reach the internet. Likely cause: No outbound rules defined. By default, all outbound traffic is denied. Fix: Add an outbound rule allowing the required protocols and ports (or allow all outbound with protocol Any to 0.0.0.0/0).

---

​

Related resources