Menu

Lumen help

Adding, editing, and deleting security group rules

Use Lumen® Edge Service Manager to add, edit, and delete security group rules for provisioned instances. Rules determine the incoming and outgoing traffic allowed by the security group. You can add or remove security groups on instances. You can also view details about, edit, create, or delete a security group.

Adding a rule to a security group
Editing a rule on a security group
Deleting a rule on a security group

Adding a rule to a security group

To add a rule to a security group:

  1. Click Infrastructure, then click Network.

    The Edge Service Manager shows the networks created for your organization.
Edge Service Manager network view
  1. Select the Security Groups tab.

    The Edge Service Manager shows the security groups for your organization.
Edge Service Manager security group list
  1. Click the security group.

    The Edge Service Manager shows the security group details page. 
Edge Services Manager security group detail view
  1. In the RULES section, click +ADD RULE.

    The Rule window appears.
Edge Service Manager add rule for security group view
  1. In the Rule window, complete the following fields:
Field Description
NAME Type a name for the rule.
DIRECTION

Select one of the following options:

  • ingress—Make a rule for incoming traffic. This selection enables the SOURCE field for the rule. If you select this option, select Instance for DESTINATION TYPE.
  • egress—Make a rule for outgoing traffic. This selection enables the DESTINATION field for the rule. If you select this option, you enable the DESTINATION or DESTINATION GROUP fields.
RULE TYPE Select the third-party service to which this rule applies. For example, select a service that provides virtual machines. If you select Custom Rule, you enable the PROTOCOL and PORT RANGE fields.
PROTOCOL
Select one of the following options:
  • TCP—Use the Transmission Control Protocol (TCP) for transmission.
  • UDP—Use the User Datagram Protocol (UDP) for transmission.
  • ICMP—Use the Internet Control Message Protocol (ICMP) for connection checking.


This field is only available if you selected Custom Rule for RULE TYPE.
PORT RANGE Type a port or range for ports (from 1 to 65000) used by the rule. For example, 22 or 6500-7500. This field is only available if you selected Custom Rule for RULE TYPE. 
SOURCE TYPE

Select one of the following options:

  • Network—Allow traffic to or from the network to which this security group is assigned.
  • Security Group—Allow traffic from all instances using a specified security group. This option is only available if you selected ingress for DIRECTION. 
  • All—Allow traffic from all sources.
SOURCE

Type one of the following sources for the rule:

  • A single IPv4 address using the /32 prefix length. For example, 101.0.121.1/32.
  • A single IPv6 address using the /128 prefix length. For example, 2002:db7:1212:1c00::231/128.
  • A range of IPv4 addresses in CIDR block notation. For example, 101.0.121.1/24.
  • A range of IPv6 addresses in CIDR block notation. For example, 2002:db7:1212:1c00::231/64.
  • The ID of a prefix list for virtual private clouds (VPC).
  • The ID of a security group.

This field is only available if you selected Network or All for SOURCE TYPE. 
SOURCE GROUP Select the security group to use to allow traffic from all instances using that security group. This field is only available if you selected Security Group for SOURCE TYPE.
DESTINATION TYPE

Select one of the following options:

  • Instance—Make an instance the destination. If you selected ingress for DIRECTION, this is the only option available.
  • Security Group—Allow traffic to all instances using a specified security group. This option is only available if you selected egress for DIRECTION. 
DESTINATION Type one of the following destinations for the rule:
  • A single IPv4 address using the /32 prefix length. For example, 101.0.121.1/32.
  • A single IPv6 address using the /128 prefix length. For example, 2002:db7:1212:1c00::231/128.
  • A range of IPv4 addresses in CIDR block notation. For example, 101.0.121.1/24.
  • A range of IPv6 addresses in CIDR block notation. For example, 2002:db7:1212:1c00::231/64.
  • The ID of a prefix list for VPCs.
  • The ID of a security group.

 

This field is only available if you selected Network or All for SOURCE TYPE.
DESTINATION GROUP Select the security group to use to allow traffic to all instances using that security group. This field is only available if you selected Security Group for DESTINATION TYPE. 
  1. Click Save Changes.

    The Edge Service Manager adds the rule to the security group.

Editing a rule on a security group

To edit a rule on a security group:

  1. Click Infrastructure, then click Network.

    The Edge Service Manager shows the networks created for your organization.
Edge Service Manager network view
  1. Select the Security Groups tab.

    The Edge Service Manager shows the security groups for your organization.
Edge Service Manager security group list
  1. Click the security group.

    The Edge Service Manager shows the security group details page. 
Edge Services Manager security group detail view
  1. In the RULES section, click the icon on the rule.

    The Rule window appears.
Edge Service Manager edit rule for a security group
  1. In the Rule window, edit the following fields as needed:
Field Description
NAME Type a name for the rule.
DIRECTION

Select one of the following options:

  • ingress—Make a rule for incoming traffic. This selection enables the SOURCE field for the rule. If you select this option, select Instance for DESTINATION TYPE.
  • egress—Make a rule for outgoing traffic. This selection enables the DESTINATION field for the rule. If you select this option, you enable the DESTINATION or DESTINATION GROUP fields.
RULE TYPE Select the third-party service to which this rule applies. For example, select a service that provides virtual machines. If you select Custom Rule, you enable the PROTOCOL and PORT RANGE fields.
PROTOCOL
Select one of the following options:
  • TCP—Use the Transmission Control Protocol (TCP) for transmission.
  • UDP—Use the User Datagram Protocol (UDP) for transmission.
  • ICMP—Use the Internet Control Message Protocol (ICMP) for connection checking.


This field is only available if you selected Custom Rule for RULE TYPE.
PORT RANGE Type a port or range for ports (from 1 to 65000) used by the rule. For example, 22 or 6500-7500. This field is only available if you selected Custom Rule for RULE TYPE. 
SOURCE TYPE

Select one of the following options:

  • Network—Allow traffic to or from the network to which this security group is assigned.
  • Security Group—Allow traffic from all instances using a specified security group. This option is only available if you selected ingress for DIRECTION. 
  • All—Allow traffic from all sources.
SOURCE

Type one of the following sources for the rule:

  • A single IPv4 address using the /32 prefix length. For example, 101.0.121.1/32.
  • A single IPv6 address using the /128 prefix length. For example, 2002:db7:1212:1c00::231/128.
  • A range of IPv4 addresses in CIDR block notation. For example, 101.0.121.1/24.
  • A range of IPv6 addresses in CIDR block notation. For example, 2002:db7:1212:1c00::231/64.
  • The ID of a prefix list for virtual private clouds (VPC).
  • The ID of a security group.

This field is only available if you selected Network or All for SOURCE TYPE. 
SOURCE GROUP Select the security group to use to allow traffic from all instances using that security group. This field is only available if you selected Security Group for SOURCE TYPE.
DESTINATION TYPE

Select one of the following options:

  • Instance—Make an instance the destination. If you selected ingress for DIRECTION, this is the only option available.
  • Security Group—Allow traffic to all instances using a specified security group. This option is only available if you selected egress for DIRECTION. 
DESTINATION Type one of the following destinations for the rule:
  • A single IPv4 address using the /32 prefix length. For example, 101.0.121.1/32.
  • A single IPv6 address using the /128 prefix length. For example, 2002:db7:1212:1c00::231/128.
  • A range of IPv4 addresses in CIDR block notation. For example, 101.0.121.1/24.
  • A range of IPv6 addresses in CIDR block notation. For example, 2002:db7:1212:1c00::231/64.
  • The ID of a prefix list for VPCs.
  • The ID of a security group.

 

This field is only available if you selected Network or All for SOURCE TYPE.
DESTINATION GROUP Select the security group to use to allow traffic to all instances using that security group. This field is only available if you selected Security Group for DESTINATION TYPE. 
  1. Click Save Changes.

    The Edge Service Manager saves the edits to the rule on the security group.

Deleting a rule on a security group

To delete a rule on a security group:

  1. Click Infrastructure, then click Network.

    The Edge Service Manager shows the networks created for your organization.
Edge Service Manager network view
  1. Select the Security Groups tab.

    The Edge Service Manager shows the security groups for your organization.
Edge Service Manager security group list
  1. Click the security group.

    The Edge Service Manager shows the security group details page. 
Edge Services Manager security group detail view
  1. In the RULES section, click the icon on the rule.
  1. In the confirmation window that appears, click OK.

    The Edge Service Manager deletes the rule on the security group.