Skip to main content

Security Groups & Firewalls

NovaPod Security Groups act as virtual firewalls controlling inbound and outbound network traffic to your GPU instances at the hypervisor level.

Default Behavior​

  • Ingress: All ports are blocked by default except the ports explicitly defined in your instance launch configuration.
  • Egress: All outbound traffic is permitted by default, allowing instances to download models from Hugging Face, pull packages via apt/pip, and push metrics to Wandb.

Creating a Rule Set​

You can create named security groups and apply them across multiple instances simultaneously:

# Create a security group for an OpenAI-compatible serving cluster
np sg create --name llm-api-sg --description "Allow SSH from office and public HTTPS"

# Add rule: Allow SSH only from your static office IP
np sg add-rule llm-api-sg \
  --direction ingress \
  --protocol tcp \
  --port 22 \
  --cidr 203.0.113.50/32

# Add rule: Allow public HTTPS traffic to API port 8000
np sg add-rule llm-api-sg \
  --direction ingress \
  --protocol tcp \
  --port 8000 \
  --cidr 0.0.0.0/0

Attaching to an Instance​

np launch \
  --gpu H100_SXM \
  --security-group llm-api-sg \
  --name secure-serving-node