Skip to content

Create a Security Group

Security groups are stateful firewalls applied at the OVN logical-switch port level. Same model as AWS / OpenStack — rules are deny-all by default, then allow what you explicitly list.

Quick steps

  1. Networks → + New Security Group (toolbar button on the Networks page).
  2. Fill in:
  3. Name — short, lowercase (e.g. web-public).
  4. Description — what the group is for.
  5. Create.
  6. Click the new row to open the rules editor.

Add a rule

Inside the rules editor:

Field Example Notes
Direction Ingress or Egress Inbound vs outbound relative to the endpoint.
Action Allow or Drop Drop lets you punch black-holes inside an otherwise open group.
Ethertype IPv4 or IPv6
Priority 1000 Lower number = checked first. Default 1000 is fine.
Protocol Any / tcp / udp / icmp
Remote CIDR 0.0.0.0/0 or 10.50.10.0/24 CIDR allowed. Use ::/0 for IPv6.
Port Min / Port Max 443 / 443 Equal min/max for a single port.

Rules are persisted to security_group_rules and pushed to OVN as ACL entries on the matching logical switch ports.

Apply a group to a VM or container

When creating a VM or container, the create modal exposes a Security Groups multi-select. Pick one or more; the matching ACLs are programmed on that endpoint's LSP. You can attach / detach groups on an existing endpoint from its detail page — the change is live within seconds.

Inspecting from OVN

ovn-nbctl acl-list <logical-switch>

MFCloud writes each rule as an ovn-nbctl acl-add entry directly on the endpoint's logical switch, matched by inport/outport == "<port-name>" — there's no intermediate OVN port-group involved (ovn-nbctl port-group-list won't show anything security-group-related). Endpoints attached to multiple groups inherit the union of all their rules.

See also