Manage Security Group Rules

GET/v2.0/security-group-rules

POST/v2.0/security-group-rules

DELETE/v2.0/security-group-rules/{rule_id}

Rules are allow-only. There is no deny rule: traffic that matches no rule is dropped, and because groups are stateful, the reply to an allowed connection is permitted without an extra rule.

info

Source: security-group-rules

List rules

curl -ks -H 'Content-Type: application/json' -H 'X-Auth-Token: gAAAAA<...>' \
'https://api.vietnix.cloud:9696/v2.0/security-group-rules?security_group_id=b7e4d2c1-8f3a-4b6d-9c05-1e2f3a4b5c60'

Add a rule

Parameters

security_group_ruleobjectrequired

Rule wrapper.

9 fields

security_group_idstringrequiredbody

ID of the group the rule belongs to.

directionstringrequiredbody

ingress or egress.

2 values

• ingress Applies to traffic entering the VM.
• egress Applies to traffic leaving the VM.

ethertypestringrequiredbody

IPv4 or IPv6.

2 values

• IPv4 IPv4 traffic.
• IPv6 IPv6 traffic.

protocolstringbody

tcp, udp, icmp, icmpv6, or null for any protocol.

5 values

• tcp Transmission Control Protocol.
• udp User Datagram Protocol.
• icmp ICMP for IPv4.
• icmpv6 ICMP for IPv6.
• any Any protocol. This is the value used when protocol is null.

port_range_minintegerbody

Start of the port range. Only valid for tcp and udp.

port_range_maxintegerbody

End of the port range. Only valid for tcp and udp.

remote_ip_prefixstringbody

Source or destination CIDR. Use 0.0.0.0/0 for any IPv4 address. Cannot be combined with remote_group_id.

remote_group_idstringbody

Allow traffic from another security group instead of a CIDR.

descriptionstringbody

Free-form description.

Sample Request — allow SSH from one network

curl -ks -X POST -H 'Content-Type: application/json' -H 'X-Auth-Token: gAAAAA<...>' \
-d '{
  "security_group_rule": {
    "security_group_id": "b7e4d2c1-8f3a-4b6d-9c05-1e2f3a4b5c60",
    "direction": "ingress",
    "ethertype": "IPv4",
    "protocol": "tcp",
    "port_range_min": 22,
    "port_range_max": 22,
    "remote_ip_prefix": "203.0.113.0/24",
    "description": "SSH from office network"
  }
}' https://api.vietnix.cloud:9696/v2.0/security-group-rules

Sample Response

JSON body

{
  "security_group_rule": {
    "id": "5c9f3a21-7d4e-4b8f-a0c6-3e2d1b0a9f88",
    "security_group_id": "b7e4d2c1-8f3a-4b6d-9c05-1e2f3a4b5c60",
    "direction": "ingress",
    "ethertype": "IPv4",
    "protocol": "tcp",
    "port_range_min": 22,
    "port_range_max": 22,
    "remote_ip_prefix": "203.0.113.0/24",
    "remote_group_id": null,
    "description": "SSH from office network",
    "tenant_id": "f5d834d636c642c7bfe8af86139c6f26"
  }
}

Status Code

Status Code	Description
201 - Created	The rule was created.
400 - Bad Request	Invalid protocol, port range, or CIDR; or remote_ip_prefix and remote_group_id were both set.
401 - Unauthorized	User must authenticate before making a request.
403 - Forbidden	Policy does not allow current user to do this operation.
404 - Not Found	The security group does not exist.
409 - Conflict	The same rule already exists in the group.

Delete a rule

curl -ks -X DELETE -H 'Content-Type: application/json' -H 'X-Auth-Token: gAAAAA<...>' \
https://api.vietnix.cloud:9696/v2.0/security-group-rules/{rule_id}

Status Code	Description
204 - No Content	The rule was deleted.
401 - Unauthorized	User must authenticate before making a request.
403 - Forbidden	Policy does not allow current user to do this operation.
404 - Not Found	The rule does not exist.

tip

Rules take effect immediately on every port that uses the group; no VM restart is needed. When a connection still fails, check the direction, the ethertype, and whether the guest firewall also blocks the port.