What is the difference between attaching a security group to a virtual network versus an individual VM?

Attaching a security group to a virtual network applies the rules to all VMs on that network, making it ideal for universal policies like outbound internet access. Attaching to an individual VM's network card provides granular control for specific workload requirements, such as allowing web server traffic only to certain VMs.

How does the target network field work in security group rules?

The target network field's meaning depends on the direction setting. For outbound rules, it defines the destination network. For inbound rules, it defines the source network. You can specify any network, a specific OpenNebula virtual network, or manual IP addresses with CIDR notation.

Network Security Groups in OpenNebula: Setup & Testing

Name: Network Security Groups in OpenNebula: Setup & Testing
Uploaded: 2026-04-06T21:12:38-04:00
Duration: 9 min 3 s
Description: TL;DR OpenNebula Security Groups act as host-level firewalls that filter traffic before it reaches VM network cards, operating on a restrictive-by-default model where all traffic is denied unless explicitly allowed. Security groups can be attached at t...

Open Nebula

04/06/2026

0 (0%)

Report Like Favorite

TL;DR

OpenNebula Security Groups act as host-level firewalls that filter traffic before it reaches VM network cards, operating on a restrictive-by-default model where all traffic is denied unless explicitly allowed.
Security groups can be attached at the virtual network level to apply rules universally, or at the individual VM network card level for granular control over specific workloads.
Rules support flexible configuration including protocol selection, port ranges (individual, ranges, or all), and target networks defined by specific IPs, network ranges, or any network.
The demonstration successfully validates security group functionality by blocking one client VM from accessing a web server while allowing another client with a whitelisted IP address to connect.

Security Groups Fundamentals

This screencast demonstrates how to implement network security in OpenNebula using Security Groups, which function as host-level firewalls that filter traffic before it reaches virtual machine network cards. Security Groups operate on a restrictive-by-default model, meaning all traffic is denied unless explicitly allowed through defined rules. The demonstration covers the complete workflow from creating security groups with specific inbound and outbound rules to assigning them at both the virtual network level and individual VM level. The tutorial uses a practical scenario with three VMs on a VXLAN EVPN network to illustrate how security groups control access to a web server running on OpenSUSE 15.

Implementation and Verification

The implementation process involves creating three distinct security groups: an outbound-sg for general internet access attached at the network level, a webserver-sg with SSH and HTTP rules for the server VM, and an rdp-sg for Windows client access. The demonstration shows how to configure rules with various parameters including protocol selection, port ranges, and target networks defined by IP addresses or network ranges. Verification is performed by deploying three VMs and testing connectivity, where one client VM with an automatically assigned IP is blocked from accessing the web server on port 80, while a second client with a specifically allowed IP address successfully connects, confirming that the security group rules are functioning as intended.

Chapters

0:00 - Introduction
0:21 - Security Groups Overview
0:55 - Configuration Options
1:33 - Demo Environment Setup
2:02 - Creating Security Groups
4:44 - Attaching to Virtual Networks
5:18 - VM Deployment and Configuration
7:29 - Testing and Verification

Key Quotes

0:21 "Consider security groups as a host-level firewall to stop the traffic flow before it reaches the virtual machine's virtual network cards."
0:41 "Security groups are restrictive by default, meaning that whatever is not explicitly allowed is denied."
1:19 "The target network field is the tricky one. The meaning of this setting is defined by the direction setting."
4:44 "In order for security groups to be effective, they must be attached to a virtual network or to an individual virtual network card on the VM."

Categories:

Tags:

Show more Show less

TL;DR

Security Groups Fundamentals

Implementation and Verification

Chapters

Key Quotes

Action1: Vulnerability Digest--Patch Tuesday & Other Updates

Understanding the True Costs of DIY Data Classification vs. Buying Solutions

Action1: The Remediation Gap: Vulnerability Management in the Age of AI

The AI-Powered VMware Alternative

LATAM: Accelerating Insights on AI Through an Engaging Webinar Series