A firewall is a network security device used to protect servers from network threats. The firewall monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules. Rules can be set for all connections.
When a Virtual Machine is in a [Load Balancer](/cloud/networking/create-and-configure-a-load-balancer) pool, configure its security group to open the ports required for receiving and transmitting data.
## Create a firewallIf no custom security group is created, the default security group is applied automatically.
1. Open the creation form in one of two ways: * In the Cloud menu, go to **Networking** > **Security Groups** > **Create Security Group**. * When creating a Virtual Machine, go to **Network settings**, expand an interface, and configure **Security Groups** for that interface.
2. Enter a name for the security group.
3. Set **Inbound rules** to define the allowed incoming traffic.
Click **Add rule** and select one of the template rules, or choose **Custom** to apply custom settings. A security group supports up to 250 rules total across inbound and outbound directions.
* Template rules (All TCP/All UDP/SSH/HTTP/HTTPS/MySQL/DNS TCP/DNS UDP/PostgreSQL/RDP TCP/RDP UDP): template rules come with pre-configured protocols and ports for typical connections * Custom rule: if you select a custom rule, specify the protocol, port, and optionally a description.
For **Sources**, specify the allowed sources for inbound traffic:
* **IP with mask**: Specify an IP address range in CIDR format (for example, 192.168.1.0/24). If left empty with "All IPv4" selected, the rule applies to all IP addresses. * **Select security groups**: Choose existing security groups to allow traffic from the instances associated with those groups.Both options can be combined. If neither is specified, the rule applies to all IP addresses.
Multiple security groups can be attached to a single Virtual Machine, and each port (interface) can have its own dedicated security group.
4. Set **Outbound rules** to define the allowed outgoing traffic.Click **Add rule** and select one of the template rules, or choose **Custom** to apply custom settings.
* Template rules (All TCP/All UDP/SSH/HTTP/HTTPS/MySQL/DNS TCP/DNS UDP/PostgreSQL/RDP TCP/RDP UDP): template rules come with pre-configured protocols and ports for typical connections * Custom rule: if you select a custom rule, specify the protocol, port, and optionally a description.
For **Destinations**, specify the allowed destinations for outbound traffic:
* **IP with mask**: Specify an IP address range in CIDR format (for example, 192.168.1.0/24). If left empty with "All IPv4" selected, the rule applies to all IP addresses. * **Select security groups**: Choose existing security groups to allow traffic to the instances associated with those groups.Both options can be combined. If neither is specified, the rule applies to all IP addresses.
Rules take effect immediately and apply to all Virtual Machines currently using this security group.
5. (Optional) Add tags by enabling **Add tags** in the **Additional options** section and specifying a key and value for each tag. 6. Click **Create Security Group**. ## Use the default firewallIf no security group is specified when creating a Virtual Machine, the default security group is applied automatically. The system creates a default security group in the default project when the service is activated.
Inbound rules — the following traffic is allowed for both IPv4 and IPv6 addresses:
* ICMP (IPv4) and ICMPv6 (IPv6) * SSH over TCP on port 22 * RDP over TCP on port 3389 * RDP over UDP on port 3389Outbound rules — all traffic is allowed.
Some operating systems also have an internal firewall that adds an additional layer of protection. To prevent misconfiguration, configure either the cloud security group or the OS firewall, but not both.
## Manage a firewallSecurity groups protect cloud infrastructure by filtering network traffic based on defined rules. The steps below cover configuring rules, assigning security groups to Virtual Machines, and deleting them.
### Add, change, and delete rulesRules can be added, edited, or removed at any time after a security group is created.
1. Go to **Networking** > **Security Groups**. 2. Find the required security group, click the Γï» menu on the right and select **Rules**.
### Assign to a Virtual Machine and detach from it
Security groups can be duplicated, assigned to Virtual Machines, or detached when no longer needed. To copy an existing security group with all its rules, click the Γï» menu and select **Duplicate**. If the target security group is already applied to the Virtual Machine, no changes are made: the system automatically detects the current state and skips unnecessary updates.
1. Go to **Networking** > **Security Groups**. 2. Find the required security group, click the Γï» menu on the right and select **Instances**.
### Delete a security group
The default security group cannot be deleted.
1. Go to **Networking** > **Security Groups**. 2. Find the required security group, click the Γï» menu on the right and select **Delete**. ### Restore a default security groupTo restore the original rules, click **Restore Default** in the security group Rules view or use the API. This resets any custom changes to the current default rule set: inbound ICMP, ICMPv6, SSH (TCP/22), and RDP (TCP/3389 and UDP/3389); outbound unrestricted.
## Firewall feature not supported for Bare Metal servers
For network security, Bare Metal servers can use the following alternatives:
* Configure network security manually using `iptables`, `nftables`, or similar tools at the OS level. For example, to allow SSH, HTTP, and HTTPS traffic while blocking everything else: ```sh theme={null} sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT sudo iptables -A INPUT -i lo -j ACCEPT sudo iptables -P INPUT DROP ``` * Enable [Gcore DDoS Protection](https://gcore.com/ddos-protection) for an additional protection layer. DDoS Protection redirects traffic to the Threat Mitigation System (TMS), which performs filtering and threat detection with its always-on mode. Contact the [support team](https://gcore.com/contact-us) for tailored plans.A [security group](/api-reference/cloud/security-groups/create-security-group) controls which traffic is allowed in and out of a virtual machine.
Set these environment variables before running the examples:
```bash theme={null} export GCORE_API_KEY="{YOUR_API_KEY}" export GCORE_CLOUD_PROJECT_ID="{YOUR_PROJECT_ID}" export GCORE_CLOUD_REGION_ID="{YOUR_REGION_ID}" export INSTANCE_ID="{YOUR_INSTANCE_ID}" export IMAGE_ID="{YOUR_IMAGE_ID}" export FLAVOR_ID="{YOUR_FLAVOR_ID}" export SG_ID="{YOUR_SECURITY_GROUP_ID}" ```The scripts below create a security group with SSH, HTTP, and HTTPS rules, attach it to a running VM, add an ICMP rule, then detach and delete the group.
A security group starts empty for inbound traffic and automatically includes default egress rules that allow all outbound traffic. Rules can be passed at creation time to avoid separate calls.
## Step-by-stepEach step below explains what the call does, which parameters matter, and what the response looks like. Use this section to understand the flow or to debug a specific step.
GET /cloud/v1/tasks/{task_id} every 5 seconds until `state` is `FINISHED`, then save the security group ID from `created_resources.security_groups[0]`:
```bash theme={null}
export SG_ID="{SG_ID}"
```
Detach the security group from all instances before deleting it, otherwise the delete request returns an error.
Declare a security group with ingress rules using [`gcore_cloud_security_group`](https://registry.terraform.io/providers/G-Core/gcore/latest/docs/resources/cloud_security_group). Rules are managed as separate `gcore_cloud_security_group_rule` resources and can be added or removed independently.
## Create a security groupDeclares a security group and its inbound rules as separate resources. Each rule references the group via `group_id` — default egress rules allowing all outbound traffic are added automatically.
```hcl theme={null} resource "gcore_cloud_security_group" "example" { project_id = var.project_id region_id = var.region_id name = "web-firewall" } resource "gcore_cloud_security_group_rule" "allow_ssh" { project_id = var.project_id region_id = var.region_id group_id = gcore_cloud_security_group.example.id direction = "ingress" ethertype = "IPv4" protocol = "tcp" port_range_min = 22 port_range_max = 22 remote_ip_prefix = "0.0.0.0/0" } resource "gcore_cloud_security_group_rule" "allow_http" { project_id = var.project_id region_id = var.region_id group_id = gcore_cloud_security_group.example.id direction = "ingress" ethertype = "IPv4" protocol = "tcp" port_range_min = 80 port_range_max = 80 remote_ip_prefix = "0.0.0.0/0" } resource "gcore_cloud_security_group_rule" "allow_https" { project_id = var.project_id region_id = var.region_id group_id = gcore_cloud_security_group.example.id direction = "ingress" ethertype = "IPv4" protocol = "tcp" port_range_min = 443 port_range_max = 443 remote_ip_prefix = "0.0.0.0/0" } output "security_group_id" { value = gcore_cloud_security_group.example.id } ``` ## Attach to a VMReference the security group in a [Virtual Machine](/cloud/virtual-instances/create-an-instance) resource. The `security_groups` block applies the group to all VM network interfaces.
```hcl theme={null} resource "gcore_cloud_instance" "example" { project_id = var.project_id region_id = var.region_id # ... other instance fields ... security_groups = [{ id = gcore_cloud_security_group.example.id }] } ``` ## Add a ruleAdd a new `gcore_cloud_security_group_rule` block and run `terraform apply`.
```hcl theme={null} resource "gcore_cloud_security_group" "example" { ... } # unchanged resource "gcore_cloud_security_group_rule" "allow_ssh" { ... } # unchanged resource "gcore_cloud_security_group_rule" "allow_http" { ... } # unchanged resource "gcore_cloud_security_group_rule" "allow_https" { ... } # unchanged resource "gcore_cloud_security_group_rule" "allow_icmp" { project_id = var.project_id region_id = var.region_id group_id = gcore_cloud_security_group.example.id direction = "ingress" ethertype = "IPv4" protocol = "icmp" remote_ip_prefix = "0.0.0.0/0" } ``` ```bash theme={null} terraform apply ``` ## Remove a ruleRemove the rule block — Terraform detects the missing declaration and deletes the rule on the next `terraform apply`.
```hcl theme={null} # Remove or comment out the rule to delete: # resource "gcore_cloud_security_group_rule" "allow_http" { # project_id = var.project_id # region_id = var.region_id # group_id = gcore_cloud_security_group.example.id # direction = "ingress" # ethertype = "IPv4" # protocol = "tcp" # port_range_min = 80 # port_range_max = 80 # remote_ip_prefix = "0.0.0.0/0" # } ``` ```bash theme={null} terraform apply ``` ## Delete a security groupRemove the security group block and all its rule blocks — Terraform deletes the rules first, then the group.
```hcl theme={null} # Remove or comment out all blocks: # resource "gcore_cloud_security_group" "example" { ... } # resource "gcore_cloud_security_group_rule" "allow_ssh" { ... } # resource "gcore_cloud_security_group_rule" "allow_http" { ... } # resource "gcore_cloud_security_group_rule" "allow_https" { ... } ``` ```bash theme={null} terraform apply ``` ## Import a security groupUse when a security group was created outside Terraform and needs to be managed as code.
```hcl theme={null} resource "gcore_cloud_security_group" "example" { project_id = var.project_id region_id = var.region_id name = "web-firewall" } ``` ```bash theme={null} terraform import gcore_cloud_security_group.example '