Check ID: networking_security_group_allows_all_ingress_from_internet
Provider: OpenStack
Service: networking
Severity: CRITICAL
Categories: internet-exposed, trust-boundaries
Resource type: OS::Neutron::SecurityGroup

​
What this check verifies

OpenStack security groups are evaluated to verify that no rule allows all ingress traffic (any protocol, any port) from the Internet (0.0.0.0/0 or ::/0). A rule with no protocol and no port restriction is effectively a “permit any” firewall rule, completely bypassing network-level access controls. This is the most permissive possible configuration and should never be used in production.

​
Risk

Allowing all inbound traffic from the Internet exposes every service on the instance to unauthorized access. Attackers can exploit any listening service including databases, management interfaces, and internal APIs. This bypasses defense-in-depth and enables initial access, lateral movement, data exfiltration, and infrastructure compromise.

​
Recommendation

Remove rules that allow all ingress traffic from the Internet. Follow the principle of least privilege by creating specific rules for only the required protocols and ports. Use security group references (remote_group_id) instead of CIDRs where possible to restrict access to known infrastructure components.

​
Remediation

# Terraform: create specific ingress rules instead of allowing all traffic

resource "openstack_networking_secgroup_v2" "web_servers" {
  name        = "web-servers-sg"
  description = "Security group for web servers"
}

# GOOD: Allow only HTTPS from the Internet
resource "openstack_networking_secgroup_rule_v2" "https_ingress" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 443
  port_range_max    = 443
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.web_servers.id
}

# GOOD: Allow SSH only from bastion security group
resource "openstack_networking_secgroup_rule_v2" "ssh_from_bastion" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_group_id   = openstack_networking_secgroup_v2.bastion.id
  security_group_id = openstack_networking_secgroup_v2.web_servers.id
}

# BAD: Never allow all traffic from the Internet
# resource "openstack_networking_secgroup_rule_v2" "allow_all" {
#   direction         = "ingress"
#   ethertype         = "IPv4"
#   remote_ip_prefix  = "0.0.0.0/0"  # DANGEROUS - no protocol/port restriction
#   security_group_id = openstack_networking_secgroup_v2.web_servers.id
# }

​
References

​
Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = networking_security_group_allows_all_ingress_from_internet. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks