Security Rules (the firewall around each server)

Security Rules are the firewall that sits around your servers. They are organised into security groups, which are named sets of rules you attach to servers. This is how you decide which ports are reachable and from where, and it is the most common networking task, so it has its own step-by-step guide: How to open a port on your server.

You will find these under Networking, then Security Rules.

How they work

• A rule allows a kind of traffic: a direction (Ingress for incoming), a protocol (TCP, UDP, ICMP), a port or range, and where it may come from (a specific address or the whole internet).
• Anything not explicitly allowed is blocked. A new server therefore accepts almost nothing until you add rules.
• A security group can be attached to many servers, so a web group that opens ports 80 and 443 can protect your whole fleet consistently.

Good habits

• Open only the ports you actually use.
• Restrict the source to specific addresses where you can, especially for SSH (port 22) and database ports.
• Group rules by role (web, db, admin) rather than making one giant group.

For the exact steps to add a rule and attach the group, follow How to open a port on your server.