[OCI] Understanding Network Security Group in Oracle Cloud (OCI)

 

When designing secure and flexible cloud architectures in Oracle Cloud Infrastructure (OCI), Network Security Groups (NSGs) are one of the most powerful tools you can use. If you've worked with Security Lists before, think of NSGs as the more flexible and precise version, giving you fine-grained control over traffic at the resource level.

🛡️ What is a Network Security Group (NSG)?

A Network Security Group (NSG) is like a private security team assigned to specific cloud resources in OCI—like virtual machines (VMs), databases, and load balancers. Instead of applying broad traffic rules across an entire subnet (like Security Lists), NSGs let you define custom security rules for individual resources or groups of resources.

🏠 Real-World Analogy

Imagine you live in a housing society:

• The main gate rules (e.g., all guests must sign in) apply to everyone—this is like a Security List for the whole subnet.

• But you also hire your own private guard just for your house with specific instructions—this is like an NSG. It follows your custom rules, no matter what the society rules are.

In other words:

• Security List = Shared gate rules

• NSG = Personalized security guard for selected homes (resources)

Now, let's see how to create a Network Security Group and attach it to a Compute Instance:

• To access the Oracle Cloud Infrastructure (OCI) Console, navigate to https://www.oracle.com/
• Upon successful login, you will be redirected to the Oracle Cloud Console homepage

• Navigate to  Navigation Menu -> Networking -> Virtual cloud networks

• Choose the compartment and click on VCN Name in which you want to create Network Security Group:

• Navigate to Network Security Group section and click Create Network Security Group button:

• Enter the below details:

1. Name
2. Choose the compartment
3. Add Ingress Rule for port 22
4. Click on Create button once done

• Network Security Group will be created:

• Now this Network Security Group can be assigned to any compute machine and all security rules will be applied. 
• Navigate to the compute machine details screen and add the Network Security Group, by clicking on Edit button:

• Select the Network Security Group and click save changes:

Now suppose if your security list of your VCN does not allow port 22, but you assign this NSG to your compute machine, then also your machine will be allowed SSH connection.