Creating Security Group Rules

Security groups and security group rules control what traffic can access the instances. You can use the Horizon dashboard GUI or the OpenStack CLI to create security rules or security groups.  Refer to OpenStack documentation or the documentation provided by your OpenStack vendor for more information. 

Prior to instantiating, you can consider adding a rule that enables the ICMP protocol to enable the instance to respond to ping message. In addition to such basic rules, the following tables provide a summary of all the ports used by the SBC SWe application in an OpenStack cloud environment. Access through these ports should be allowed by adding security rules in the default security group or in another security group you create and associate with the instance. 

You can continue to add, delete, or modify security rules after the instance is deployed. 

The fields in the following tables are:

• Direction (initial) - for UDP, this will be BOTH. For TCP, this will be OUTBOUND for clients and INBOUND for servers (to match the direction of the initial connection). 

  These definitions match the way firewall rules typically have to be defined.

• Ether Type - It is either IPv4 or IPv6. Separate rules are supplied when both IPv4 and IPv6 are supported.
• IP Protocol - UDP or TCP.
• Local Port - an exact port number, or a wildcard. Note that TCP clients usually use an ephemeral local port which must be wildcarded.
• Local IP/interface - the local interface or internal object (such as SIP SP)
• Remote Port - an exact port number, or a wildcard. Note that TCP clients usually use an ephemeral local port (which must be wildcarded).
• Remote Peers - peer type. Use this to set the most constrained remote network prefix. 

The following three tables provide input for security rules grouped by port type.