Create a Security Group¶

Security groups are stateful firewalls applied at the OVN logical-switch port level. Same model as AWS / OpenStack — rules are deny-all by default, then allow what you explicitly list.

Quick steps¶

Networks → Security Groups → + New Security Group.
Fill in:
Name — short, lowercase (e.g. web-public).
Description — what the group is for.
Create.
Click the new row to open the rules editor.

Add a rule¶

Inside the rules editor:

Field	Example	Notes
Direction	`Ingress` or `Egress`	Inbound vs outbound relative to the endpoint.
Protocol	`tcp` / `udp` / `icmp`	Leave blank for "any protocol".
Port Min	`443`	Numeric.
Port Max	`443`	Equal to port_min for single port.
Remote	`0.0.0.0/0` or `10.50.10.0/24`	CIDR allowed. Use `::/0` for IPv6.
Action	`allow` or `deny`	`deny` lets you punch black-holes inside an otherwise open group.
Priority	`100`	Lower number = checked first. Default 100 is fine.

Rules are persisted to security_group_rules and pushed to OVN as ACL entries on the matching logical switch ports.

Apply a group to a VM or container¶

When creating a VM or container, the create modal exposes a Security Groups multi-select. Pick one or more; the matching ACLs are programmed on that endpoint's LSP. You can attach / detach groups on an existing endpoint from its detail page — the change is live within seconds.

Default groups (read-only)¶

Name	Purpose
`default`	Allow all egress, allow all ingress within the same group. Same as OpenStack's stock group.
`ssh-mgmt`	Ingress `tcp/22` from anywhere; useful for management-only VMs.

Operators can't edit or delete these; clone them to a new name to build something custom.

Inspecting from OVN¶

ovn-nbctl acl-list <logical-switch>
ovn-nbctl port-group-list

MFCloud maps each security group to an OVN port-group, then writes ACLs against that port-group. Endpoints attached to multiple groups inherit the union of all their rules.