> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nebius.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing security groups and security rules

To set up a firewall for your [Compute](/compute/index) virtual machines (VMs), you can create [security groups](/vpc/security-groups/overview) with security rules that control ingress and egress traffic at the packet level, and then assign the security groups to the VMs' network interfaces.

## Prerequisites

1. [Install and configure the Nebius AI Cloud CLI](/cli/quickstart).
2. Make sure you are in a [group](/iam/authorization/groups/index) that has at least the `editor` role within your tenant or project; for example, the default `editors` group. You can check this in the [Administration → IAM](https://console.nebius.com/iam) section of the web console.
3. [Get the ID of the network](/vpc/networking/resources#how-to-get-a-network-id) where you want to manage security groups and security rules.

## Creating security groups

To create a security group, run `nebius vpc security-group create`:

```bash theme={null}
nebius vpc security-group create \
  --name <name> \
  --network-id <network_ID>
```

The command contains the following parameters:

* `--name`: Name of the security group.
* `--network-id`: ID of the network for the security group. You can only assign a security group to VMs within this network. For instructions, see [How to get a network ID](/vpc/networking/resources#how-to-get-a-network-id).

For more details, see the [command reference](/cli/reference/vpc/security-group/create).

Security groups are created empty. After creating a security group, [add security rules to it](#adding-security-rules-to-security-groups) and then [assign it to VMs](#assigning-security-groups-to-vms).

## Adding security rules to security groups

To add a security rule to a security group, run `nebius vpc security-rule create`. For example, to create an egress security rule, run the following command:

```bash theme={null}
nebius vpc security-rule create \
  --parent-id <security_group_ID> \
  --name <name> \
  --access <allow|deny> \
  --egress-destination-cidrs "<CIDR_block_1>,<CIDR_block_2>,..." \
  --egress-destination-ports "<CIDR_port_1>,<CIDR_port_2>,..." \
  --egress-destination-security-group-id <destination_security_group_ID> \
  --protocol <tcp|udp|icmp|any> \
  --type <stateful|stateless> \
  --priority <priority_from_1_to_1000>
```

To get a security group ID, run `nebius vpc security-group list`. The output contains the ID in the `.metadata.id` parameter.

For more details, see:

* [Command reference](/cli/reference/vpc/security-rule/create)
* `--egress-destination-security-group-id` (and `--ingress-source-security-group-id`): [Security groups as sources or destinations in security rules](/vpc/security-groups/overview#security-groups-as-sources-or-destinations-in-security-rules)
* `--type`: [Security rule types: stateful and stateless](/vpc/security-groups/overview#security-rule-types-stateful-and-stateless)
* `--priority`: [Security rule priorities](/vpc/security-groups/overview#security-rule-priorities)

## Deleting security rules

To delete a security rule from a security group, run the `nebius vpc security-rule delete` command:

```bash theme={null}
nebius vpc security-rule delete <security_rule_ID>
```

To get the security rule ID, run `nebius vpc security-rule list --parent-id <security_group_ID>`.

For more details, see the [command reference](/cli/reference/vpc/security-rule/delete).

If you delete all security rules from a security group, it denies all traffic to and from VMs' network interfaces that it is assigned to. For more details, see [Security rule priorities](/vpc/security-groups/overview#security-rule-priorities).

## Assigning security groups to VMs

A VM and security groups that are assigned to it must be associated with the same network.

To assign a security group to a VM's network interface, add the security group ID to the specification of the network interface when creating or modifying the VM. For example, to add a security group to an existing VM, perform the following steps:

1. Run `nebius compute instance edit <VM_ID>`.

2. Modify the `.spec.network_interfaces` parameter:

   ```diff theme={null}
    spec:
      network_interfaces:
        - ip_address:
            allocation_id: vpcallocation-***
          name: eth0
          public_ip_address:
            static: false
          subnet_id: vpcsubnet-***
   +      security_groups:
   +        - id: vpcsecuritygroup-***
   ```

3. Save the edited specification and exit the editor to apply the change to the VM.

To get the security group ID, run `nebius vpc security-group list`.

For more details, see reference for commands that create and modify VMs:

* [nebius compute instance create](/cli/reference/compute/instance/create)
* [nebius compute instance update](/cli/reference/compute/instance/update)
* [nebius compute instance edit](/cli/reference/compute/instance/edit)

If no security groups are assigned to a VM's network interface, the [default security group](/vpc/security-groups/overview#default-security-groups) of the VM's network controls traffic to and from this network interface. You can achieve this by making the list of the network interface's security groups empty.

## Deleting security groups

<Warning>
  You can only delete non-default security groups that are not assigned to any VMs. Before deleting a security group, assign other security groups to its VMs or revert these VMs to defaults. For more details, see [Assigning security groups to VMs](#assigning-security-groups-to-vms).
</Warning>

To delete a security group, run `nebius vpc security-group delete`:

```bash theme={null}
nebius vpc security-group delete <security_group_ID>
```

To get the security group ID, run `nebius vpc security-group list`.