Security groups

General information

Security groups describe rules for traffic filtering on network interfaces of the instances connected to a subnet, thus acting as a virtual firewall.

Billing

Security groups are free of charge.

Available quotas

The following default quotas are allocated to security groups:

• 500 security groups per a VPC;

• 5 security groups per a network interface;

• 50 rules in each direction per a security group.

If necessary, you can increase quotas. To do this, contact the support service via the support portal or by email support@k2.cloud.

Default security group

A default security group is created together with a VPC. It is associated with the network interface when it is created.

Inbound rules for the default security group

Protocol	Source	Ports	Description
All	The secuity group (sg-XXXXXXXX)	All	Enables inbound traffic from interfaces with the default security group

Outbound rules for the default security group

Protocol	Destination	Ports	Description
All	0.0.0.0/0	All	Allows all outbound IPv4 traffic

You can change the rules of the default security group or associate your security groups with a network interface. In each security group, you can define rules for both inbound and outbound traffic.

Stateful inspection

Security Groups perform stateful traffic filtering: for each new allowed network connection, a temporary reverse rule is created automatically. This rule dynamically allows return traffic for this connection.

Note

For example, a web server runs on an instance in the cloud on TCP port 80. The corresponding network interface is assigned the web-sg security group, which has the inbound allow rule tcp/80, 0.0.0.0/0. The list of outbound rules is empty. When a TCP session is opened between a client and the web server, a temporary outbound allow rule is created: proto: tcp, source port: 80, destination port: XXXX, destination IP: client IP, where XXXX is an ephemeral port that the client OS dynamically selects for the current TCP session. This rule remains in effect until the connection is closed or the timeout expires. The timeout length depends on the protocol.

Stateless filtering

By default, K2 Cloud security groups perform stateful filtering: return traffic is automatically allowed for each permitted connection. For details, see Stateful inspection.

The number of connections that can be tracked simultaneously for one instance is limited. With hundreds of thousands of active or frequently created connections, we recommend using the stateless mode, in which traffic is processed without tracking connection state.

This mode does not need to be enabled separately. It is applied automatically to traffic if it is allowed by both an inbound and an outbound rule of the same security group. The source and destination in these rules must be specified as a network in CIDR format. The mode applies to any protocol.

When to use

The stateless mode is suitable for applications that create a large number of new TCP or UDP connections, for example:

• proxy servers and network gateways;

• high-load web services;

• load balancers;

• systems with a large number of connections.

For such traffic, both directions must be explicitly allowed.

How to configure rules

For traffic to be processed without state tracking, create matching inbound and outbound rules in the same security group.

1. Select the protocol, for example, TCP, UDP, or all protocols.

2. For TCP or UDP, allow access to all ports. If you restrict the set of ports, the stateful mode will be applied to the traffic. For other protocols, the set of ports is not specified.

3. Specify a network in CIDR format as the source in the inbound rule or as the destination in the outbound rule.

4. Create an allow rule for the reverse direction in the same security group. In it, specify a network that matches the network from the previous step or fully includes it (for example, if 192.0.2.0/25 was specified, you can specify 192.0.2.0/25 or 192.0.2.0/24 in this rule).

5. Assign the security group to the network interfaces whose traffic should be processed in the stateless mode.

Note

Make sure that the inbound and outbound rules specify the same protocol or that one of the rules includes all protocols.

Note

The stateless mode applies only to traffic allowed in both directions by the rules of the same security group. Other traffic continues to be processed in the stateful mode. If a security group is specified as the source or destination, the stateless mode does not apply to such traffic.

TCP example

To avoid tracking TCP connections between an instance and the 10.0.0.0/8 network, you can set the following rules in the same security group:

Rules for TCP traffic with the 10.0.0.0/8 network

Direction	Protocol	Ports	Source or destination
Inbound	TCP	All	10.0.0.0/8
Outbound	All	All	0.0.0.0/0

The inbound rule allows TCP traffic from the 10.0.0.0/8 network. The outbound rule covers all outbound traffic and thus allows TCP traffic to this network. TCP traffic between the instance and addresses from the 10.0.0.0/8 network is allowed in both directions, so it is transmitted without connection tracking.

Traffic of other protocols and TCP traffic for other networks continues to be processed in the stateful mode.

Note

The outbound rule in the example matches the outbound rule of the default security group: all protocols, all ports, destination 0.0.0.0/0. If this outbound rule has not been changed, create only an inbound rule in the same group: TCP protocol, all ports, source 10.0.0.0/8. You do not need to create a new outbound rule.

Example for all IPv4 traffic

To enable stateless processing of all IPv4 traffic, allow all protocols in both directions in the same security group:

Rules for all IPv4 traffic

Direction	Protocol	Ports	Source or destination
Inbound	All	All	0.0.0.0/0
Outbound	All	All	0.0.0.0/0

Attention

This configuration allows any inbound and outbound IPv4 traffic. Use it only in a network fully isolated from the outside world or together with additional security measures, for example, network access control lists.

Stateless filtering specifics

Attention

Changing or deleting a rule may interrupt connections that are transmitted without state tracking.

In the stateless mode, consider the following:

• return traffic must be explicitly allowed by a separate rule of the same security group;

• the overlap of inbound and outbound rules is determined within the same security group;

• the stateless mode applies only to the overlapping part of the inbound and outbound rules: the network and protocol allowed by both rules;

• other networks and protocols continue to use stateful filtering;

• if the rules specify a restricted set of ports, the stateless mode does not apply to such traffic;

• we recommend allowing access only from trusted networks and not opening 0.0.0.0/0 unless necessary.

Operations with security groups

Create a security group

1. Go to Virtual machines Security Security groups.

2. Click Create.

3. In the window that opens, set the following parameters:

   • VPC where you need to create a security group;

   • Name tag (optional);

   • security group name;

   • description (optional).

4. If you need to set tags, go to the next step by clicking Add tags. Specify the tag key and value.

5. After setting all the required parameters, click Create.

Assign a security group to an interface

You can assign a security group to any network interface or remove it from the assigned ones in the Security groups tab on the page of the respective interface. How to change security groups of a network interface is detailed in the respective section of documentation on network interfaces. The list of interfaces to which a specific security group was assigned can be viewed in the Network interfaces tab on the page of the respective group.

Assign tags to a security group

1. Go to Virtual machines Security Security groups.

2. In the resource table, find the security group for which the tags should be edited and click on its ID to go to the security group page.

3. Open the Tags tab.

4. To add a tag, click Add tag and specify the Key and Value fields.

   To modify a tag, edit the required fields (Value and/or Key) of the respective tag.

   To delete a tag, click the icon next to the tag you no longer need.

   Note

   If no tags have been set earlier, you can add the Name tag by clicking Add Name tag and specifying its value.

   Note

   You can also modify the Name tag in the Information tab by editing the corresponding field.

5. Click Apply to save the changes.

Edit the description of a security group

1. Go to Virtual machines Security Security groups.

2. Find the security group in the resource table and click its ID to go to the group page.

3. In the Information tab, edit the security group name, its description and/or the Name tag.

4. Save the changes.

Delete a security group

Important

You can delete a security group only if it meets the following criteria:

• a security group is not assigned to any network interface;

• the security group is not the default security group;

• the security group is not set as a source or a destination in another security group.

1. Go to Virtual machines Security Security groups.

2. In the resource table, select the group and click Delete.

3. In the window that opens, confirm the deletion.

This operation can also be performed on the page of the security group. To do this, go to the Information tab and click Delete.

Working with rules

Add a rule

The new rule will be automatically applied to all interfaces associated with this security group.

Important

Rules, where the source/destination is a security group, are limited to a single availability zone. If you want to permit traffic between network interfaces located in different availability zones inside a region, specify IP addresses as the sources/destinations in the permitting rules.

Note

If a security group is associated with a network interface, which has disabled sourceDestCheck parameter, you cannot use this security group as a source in either its own or inbound rules in other security groups.

To add an inbound or outbound rule to a particular security group:

1. Go to Virtual machines Security Security groups.

2. Find the security group in the resource table and click its ID to go to the group page.

3. Open the required Inbound rules or Outbound rules tab and click Add.

4. In the window that opens, set the required parameters:

   • (Optional) Rule description.

   • Protocol — You can set the rule for all protocols or select a specific protocol from the list. If there is no required protocol on the list, select Other.

     • Protocol number — If the protocol is not on the list, set its number according to IANA.

     • Port access — For TCP and UDP, specify whether all or specific ports can be accessed.

     • Ports — If you select access for some ports only, specify a comma-separated list of ports and/or port ranges.

       Important

       A separate rule will be created for each port or port range in the list.

   • Grant access — You can grant access from all IP addresses, a particular network, or security group.

     • Network — If you select From Network, specify the network in CIDR notation.

     • Security group — If you select From security group, select a security group from the drop-down list.

5. Once all parameters are set, click Add to create a rule.

Modify a rule

You can modify any rule parameters except for the source type (network or security group) for inbound rules and except for the destination type (network or security group) for outbound rules.

To change an inbound or outbound rule for a particular security group:

1. Go to Virtual machines Security Security groups.

2. Find the security group in the resource table and click its ID to go to the group page.

3. Open the required Inbound Rules or Outbound Rules tab, select the rule to be modified in the resource list, and click Modify.

4. In the window that opens, you can edit the following parameters:

   • Rule description.

   • Protocol — Instead of the protocol in use you can set an arbitrary one or select all protocols. If there is no required protocol on the list, select Other.

     • Protocol number — If the protocol is not on the list, set its number according to IANA.

     • Port access — For TCP and UDP, you can change whether all or specific ports can be accessed.

     • Ports — If access only to specific ports has been selected, you can specify a different port or port range.

   • Network/Security group — If access was allowed from a network or from all addresses, you can specify another network, including granting access from everywhere (0.0.0.0/0). If access was allowed from a security group, you can select another security group.

5. Once the parameters are edited, click Change to save the rule.

Delete a rule

You can delete several rules simultaneously.

1. Go to Virtual machines Security Security groups.

2. Find the security group in the resource table and click its ID to go to the group page.

3. Open the required Inbound rules or Outbound rules tab, select the rule(s) to be deleted in the resource list, and click Delete.

4. In the window that opens, confirm the deletion.

Security group information

For general information about the existing security groups, see the Security groups subsection. To view all security groups in the project, select All VPC in the VPC filter. To display security groups from a particular VPC, select the desired VPC in the filter.

To view detailed information about a particular security group, go to Virtual machines Security Security groups and select the required security group from the list.

To view detailed information about a particular security group, go to Networking Security groups and select the required security group.

To simplify finding a group in the table, you can select the VPC in which the group was created in the VPC filter, or use the table search.

Once you have selected the desired group, click its ID. The security group page will open.

The Information tab displays the main group parameters:

• Name tag;

• security group name and description;

• number of network interfaces to which the group is assigned;

• VPC in which the group was created.

Here you can modify the Name tag, modify the group description or delete it.

The Inbound rules tab displays a table with details of inbound rules:

• protocol;

• source from which access is allowed;

• ports;

• description.

You can add or delete a rule, as well as modify its description.

The Outbound rules tab displays a table with details of outbound rules:

• protocol;

• destination to which access is allowed;

• ports;

• description.

You can add or delete a rule, as well as modify its description.

The Network interfaces tab displays a table with details of the network interfaces to which this group is assigned:

• ID;

• name;

• description;

• associated Private IP;

• associated Elastic IP;

• instance to which the interface is attached;

• state;

• subnet where the interface was created.

The sequence and scope of the displayed data may vary depending on the table settings.

In the Tags tab, you can view tags assigned to the security group. You can add, change and delete tags.