# Create a Security Group

## Procedures

### Step 1 - Sign in and go to create

1. Log in to [**zenConsole**](https://console.zenlayer.com/).
2. Go to **Compute** > **Virtual Machine** > **Security Group** and click **Create Security Group**.

### Step 2 - Identify your security group

### Step 3 - Configure the inbound and outbound rules

<table><thead><tr><th width="148">Item</th><th>Description</th></tr></thead><tbody><tr><td>Type</td><td><strong>Accept</strong>：allows access requests on a specific port.</td></tr><tr><td>Priority</td><td>A smaller value indicates a higher priority.<br><strong>Valid values</strong>: 1 to 100.</td></tr><tr><td>Protocol</td><td>The protocol type of the security group rule.<br><strong>Valid values</strong>: All/TCP/UDP/All ICMP (IPv4)</td></tr><tr><td>Port range</td><td>You can specify a port range when <strong>Protocol Type</strong> is set as <strong>TCP</strong> or <strong>UDP</strong>. Enter one or more port ranges. Separate the port ranges with commas (,). <strong>Example</strong>: 22/23, 443/443.</td></tr><tr><td>Source/<br>Destination</td><td>Configure the host IP addresses of source and destination.<br><strong>Example</strong>: 192.168.0.0/24. 0.0.0.0/0 or ::/0 indicates all IP addresses are allowed.</td></tr><tr><td>Actions</td><td>Delete the rule.</td></tr></tbody></table>

* Commonly used port explanations are shown as follows:

<table><thead><tr><th width="140.33333333333331">Protocol</th><th width="80">Port</th><th>Description</th></tr></thead><tbody><tr><td>ICMP</td><td>-1/-1</td><td>The ICMP port. It is used to ping instances through the Internet for network management and debugging.</td></tr><tr><td>SSH</td><td>22</td><td>The SSH port. It is used to remote access to Linux instances.</td></tr><tr><td>Telnet</td><td>23</td><td>The Telnet port. It is used to log in to instances.</td></tr><tr><td>HTTP</td><td>80</td><td>The HTTP port. Use a VM instance as a Web server.</td></tr><tr><td>HTTPS</td><td>443</td><td>The HTTPS port. It is used to access web services. HTTPS protocol is encrypted and secured.</td></tr><tr><td>SQL Server</td><td>1433</td><td>The TCP port of SQL Server. It is used for MySQL to provide external services.</td></tr><tr><td>Oracle</td><td>1521</td><td>The Oracle communication port. If your instances run Oracle SQL, you need to open this port.</td></tr><tr><td>MySQL</td><td>3306</td><td>The MySQL port. It is used for MySQL to provide external services.</td></tr><tr><td>Windows Remote Desktop</td><td>3389</td><td>The Windows Server Remote Desktop Services (RDP) port. It is used to log in to Windows instances.</td></tr><tr><td>PostgreSQL</td><td>5432</td><td>The PostgreSQL port. It is for PostgreSQL to provide external services.</td></tr><tr><td>Redis</td><td>6379</td><td>The Redis port. It is used for Redis to provide external services.</td></tr></tbody></table>

<table><thead><tr><th width="88.33333333333331">Port</th><th width="139">Source IP</th><th>Description</th></tr></thead><tbody><tr><td>-1/-1</td><td>10.0.0.0/8</td><td>Allow access from private IP range <code>10.0.0.0/8</code> to all ports</td></tr><tr><td>-1/-1</td><td>172.16.0.0/12</td><td>Allow access from private IP range <code>172.16.0.0/12</code> to all ports</td></tr><tr><td>-1/-1</td><td>192.168.0.0/16</td><td>Allow access from private IP range <code>192.168.0.0/16</code> to all ports</td></tr></tbody></table>

* Typical applications of commonly used ports are shown as follows:

<table><thead><tr><th width="146">Scenario</th><th width="115">Rule direction</th><th width="141">Authorization policy</th><th width="102">Protocol type</th><th width="81">Port range</th><th width="140">Authorization type</th><th width="133">Authorization object</th><th>Priority</th></tr></thead><tbody><tr><td>Remote access to Linux instances through SSH</td><td>Inbound</td><td>Allow</td><td>SSH (22)</td><td>22/22</td><td>Address field access</td><td>0.0.0.0/0</td><td>1</td></tr><tr><td>Remote access to Windows instances through RDP</td><td>Inbound</td><td>Allow</td><td>RDP (3389)</td><td>3389/3389</td><td>Address field access</td><td>0.0.0.0/0</td><td>1</td></tr><tr><td>Ping VM instances through the Internet</td><td>Inbound</td><td>Allow</td><td>ICMP</td><td>-1/-1</td><td>Address field access or security group access</td><td>Set this parameter according to the authorization type</td><td>1</td></tr><tr><td>Use a VM instance as a Web server</td><td>Inbound</td><td>Allow</td><td>HTTP (80)</td><td>80/80</td><td>Address field access</td><td>0.0.0.0/0</td><td>1</td></tr><tr><td>Upload or download files through FTP</td><td>Inbound</td><td>Allow</td><td>Custom TCP</td><td>20/21</td><td>Address field access</td><td>0.0.0.0/0</td><td>1</td></tr></tbody></table>

{% hint style="info" %} <mark style="color:blue;">**Note**</mark>

<mark style="color:blue;">For security reasons, starting from November 27, 2023, you're restricted to access to</mark> <mark style="color:blue;"></mark><mark style="color:blue;">**port 25**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">for email transmission by default. If you require continued access to</mark> <mark style="color:blue;"></mark><mark style="color:blue;">**port 25**</mark><mark style="color:blue;">, you may submit a request to remove the restriction.</mark>
{% endhint %}

### Step 4 - Select an instance to apply the security group to

### Step 5 - *<mark style="color:green;">(Optional)</mark>* describe the security group

### Step 6 - Click ***Create*** to create a security group

### Step 7 - Manage security groups

* Deploy the security group\
  On the security group interface, click the instances deployed the security group on to change or add the instance.
* Edit the security group\
  On the security group interface, click **Edit** to change inbound and outbound rules.
* Delete the security group\
  On the security group interface, click **Delete** to delete the security group then the instance will not be controlled by the rules.