Security groups and VPC peering

Decide which services may reach which, on which ports, and join the networks of two projects.

Security groups

  1. Go to the VPC menu and open Security groups.
  2. Under Service tags, give each service a tag for its role, such as web, api or db.
  3. Click New group, name it, and choose the services it applies to by tag or directly.
  4. Click Add rule: choose the protocol and port, then the source, such as services with a tag, a specific service, another group, an IP range or a peered VPC.
  • Rules only allow. Inbound stays closed unless a rule opens it; outbound stays open until you add the first outbound rule.
  • New services join the Default group, where members reach each other on every port. It can’t be deleted, but you can take services out of it.
  • Up to 100 rules per group.

Security groups control traffic between services in the VPC and from peered VPCs. They don’t control internet visitors who reach a public service through its web address.

VPC peering

  1. Go to VPC > Peering and click Request peering.
  2. Choose A project in this account and pick the project, or Another account and enter the owner’s email address and their project slug, then click Send request.
  3. The other side clicks Accept.
  4. On each side, add a security group rule whose source is the peered VPC, or a group the other side shares.
  • The two VPCs’ IP ranges must not overlap.
  • Peering only carries traffic between services in the same region. Across regions, use a Network Hub.
  • Peering isn’t transitive: if A peers with B and B with C, A still can’t reach C.
  • To let the other side name one of your groups in their rules, turn on Let peered VPCs name this group. They only ever see its name, never your services or their addresses.

If something goes wrong

Peering is active, but services in another region can’t reach each other

Peering only works within one region. Attach both VPCs to a Network Hub instead (see Network Hub).

Two services can’t reach each other after I set up security groups

Check that a group on the receiving service has an inbound rule naming the sender (by tag, service or group) on the right port. If the sender has any outbound rule, it can only go where its outbound rules allow.

Peering is active, but nothing gets through

Peering opens nothing on its own. Add a security group rule with the peered VPC, or one of its shared groups, as the source.

I can’t request peering because the IP ranges overlap

Move one VPC to a range that doesn’t overlap, in VPC settings (see VPC and subnets). The services in that project stop for a while during the move, so it’s best to plan ranges before you create services (see Landing zone).

Still stuck? Let our team help

Open a ticket from the Console. Tell us the site or service, what you did and the message on screen. Our reply comes back in the same ticket, so everything stays in one place.

Open a ticket All guides