Skip to main content
Updated May 8, 2026 The raff security-group command group manages Firewall Groups. The dashboard product is called Firewall; the underlying API path is security-groups, which is what the CLI command name reflects. Functionality is the same — see Firewall overview for the model. To attach a group to a VM, use raff vm sg add (see VM commands → sg add). The CLI doesn’t yet expose Update Rules — use the Update Firewall API directly for now.

​
Subcommand index

​
list

​
templates

Lists the 5 System templates: web-server, database-server, ssh-only, allow-all, deny-all. Use the id field as --template-id on create to start from a template.

​
get

Show a Firewall Group’s full inbound and outbound rule set, plus the VMs it’s attached to.

​
create

Create a Firewall Group. Either start from a template (--template-id web-server), pass rules as JSON via --rules-file, or both (rules merge with template). Rule format follows the Create Firewall API schema:
Maximum 40 inbound rules + 40 outbound rules per group. The system Default Firewall blocks TCP 135/139/445/5985–5986 and UDP 137–138 — those are stripped from any rule range you submit.

​
delete

Delete a Firewall Group. Fails if it’s still attached to any VM — detach with raff vm sg remove on each VM first.

​
Reboot reminder

Any rule change (create, attach, detach, delete) requires a VM reboot for the new rules to take effect inside the guest. The platform record updates immediately; the guest network stack picks it up only at boot. See Update rules for the full reboot rule.

VM commands

raff vm sg add to attach to a VM.

Firewall overview

The two-layer firewall model.

Inbound vs outbound

Rule format, port ranges, CIDR.
Last modified on May 8, 2026