> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nscale.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Security groups
A security group is a set of stateful firewall rules that control inbound and outbound traffic to your resources. Security groups are tied to a VPC and can be reused across all resources in that VPC. You need at least one security group before creating an instance. By default, all traffic is denied — you must explicitly add rules to allow it.
**Prerequisite:** You need an existing [VPC network](/docs/network/vpc-networks) before creating a security group.
## Summary
This page explains how to create and manage **security groups** in the Nscale Console UI.
Use this workflow if you:
* Need to control which traffic can reach your instances and clusters
* Want to define reusable firewall rules within a VPC
* Are setting up networking before creating instances (a security group is required)
## Availability
This feature is available for **On-demand** and **Reserved** cloud services.
## Requirements
* A **VPC network** to associate the security group with
* Permission and sufficient **quota** to create security groups
**Default behaviour:** With no rules defined, all inbound and outbound traffic is **denied**. You must add rules to allow the traffic your workloads need.
## Key concepts
* **Inbound rules** control traffic coming **into** your resources (e.g., SSH connections from your IP)
* **Outbound rules** control traffic going **out** from your resources (e.g., internet access for package downloads)
* **Stateful:** If you allow an inbound connection, the return traffic is automatically allowed (and vice versa)
### CIDR notation
Security group rules use CIDR notation to specify IP ranges:
`0.0.0.0/0` = all IP addresses (open to the internet). `10.0.1.0/24` = a specific subnet (256 addresses). `203.0.113.50/32` = a single IP address.
### Protocol reference
| Protocol | When to use |
| -------- | ----------------------------------------------------------------------------------------------------------------------------- |
| **TCP** | Most common — used for SSH (port 22), HTTP (80), HTTPS (443), and application traffic |
| **UDP** | Used for DNS (port 53), some streaming/gaming protocols |
| **Any** | Allows all protocols — use with caution |
| **VRRP** | Virtual Router Redundancy Protocol — used for high-availability failover. Most users don't need this; use TCP/UDP/Any instead |
## Common rule examples
| Use Case | Direction | Protocol | Port Range | Source/Destination CIDR |
| ------------------- | --------- | -------- | ---------- | ------------------------------------- |
| Allow SSH access | Inbound | TCP | 22 | `0.0.0.0/0` or your IP (`x.x.x.x/32`) |
| Allow HTTP traffic | Inbound | TCP | 80 | `0.0.0.0/0` |
| Allow HTTPS traffic | Inbound | TCP | 443 | `0.0.0.0/0` |
| Allow all outbound | Outbound | Any | All | `0.0.0.0/0` |
## Security group lifecycle
| Action | Details |
| -------------- | --------------------------------------------------------------------------- |
| **Create** | Provide a name, select a VPC, add an optional description, and define rules |
| **Edit rules** | Add, modify, or remove individual rules at any time |
| **Delete** | Remove the security group when it is no longer needed |
You **cannot delete a security group** that is currently attached to active resources (instances, clusters). Detach or delete the associated resources first.
## Step-by-step
### Create a security group
1. In the Console, open your project, then go to **Network → Security Groups**
2. Click the **+ New** button in the top-right corner
3. A side panel opens with the creation form:
* **Name**: Enter a name for the security group
* **VPC**: Select the VPC this security group will belong to
* **Description** (optional): Add a description (up to 200 characters)
4. Click **Add Rules** to define your firewall rules:
* Choose **Inbound** or **Outbound**
* Select the **Protocol** (TCP, UDP, Any, or VRRP)
* Enter the **Port Range** (e.g., `22` for SSH, `80` for HTTP, or `1-65535` for all ports)
* Enter the **CIDR** block (e.g., `0.0.0.0/0` for all IPs)
* Add as many rules as needed
5. Click **Create** to save the security group
### View security group details
Click any security group in the list to view its detail page. The detail page has four tabs:
* **Overview** — summary of rules, linked instances, and configuration details (VPC, region, project)
* **Rules** — full table of inbound and outbound rules with add/edit side panels
* **Instances** — all instances using this security group, with search filtering
* **Settings** — rename the security group or delete it
### Managing security groups
To **edit rules** on an existing security group:
1. Go to **Network → Security Groups** and select the security group
2. Open the **Rules** tab
3. Add, modify, or remove rules as needed
4. Save your changes
To **rename** a security group:
1. Open the security group detail page and go to the **Settings** tab
2. Edit the name and save
To **delete** a security group:
1. Ensure no resources are attached to it (check the **Instances** tab)
2. Go to the **Settings** tab and click **Delete**, or use the actions menu from the list page
## Common issues / troubleshooting
* **Symptom:** Can't delete a security group.
**Likely cause:** The security group is attached to one or more active resources (instances, clusters).
**Fix:** Remove or delete the associated resources, then try deleting the security group again.
* **Symptom:** Instance is unreachable via SSH.
**Likely cause:** No inbound rule for SSH (TCP port 22) in the instance's security group.
**Fix:** Go to **Network → Security Groups**, select the security group attached to the instance, and add an inbound rule for TCP port 22 from your IP or `0.0.0.0/0`.
* **Symptom:** Instance can't download packages or reach the internet.
**Likely cause:** No outbound rules defined. By default, all outbound traffic is denied.
**Fix:** Add an outbound rule allowing the required protocols and ports (or allow all outbound with protocol **Any** to `0.0.0.0/0`).
***
## Related resources
Create the VPC your security group belongs to
Attach security groups when creating instances
Manage security groups as infrastructure as code
Manage security groups programmatically via the Networking and Storage API