raff security-group

_{Updated November 5, 2026} The raff security-group command group manages Firewall Groups. The dashboard product is called Firewall; the underlying API path is security-groups, which is what the CLI command name reflects. Functionality is the same — see Firewall overview for the model. To attach a group to a VM, use raff vm sg add (see VM commands → sg add). The CLI doesn’t yet expose Update Rules — use the Update Firewall API directly for now.

Subcommand index

Subcommand	What it does
`list`	List Firewall Groups in the project
`templates`	List the 5 prebuilt templates
`get`	Show one group’s full rule set
`create`	Create a new Firewall Group
`delete`	Delete a Firewall Group

list

raff security-group list [--output table|json]

templates

raff security-group templates [--output table|json]

Lists the 5 System templates: web-server, database-server, ssh-only, allow-all, deny-all. Use the id field as --template-id on create to start from a template.

get

raff security-group get <sg-id> [--output table|json]

Show a Firewall Group’s full inbound and outbound rule set, plus the VMs it’s attached to.

create

raff security-group create \
  --name <name> \
  [--description <text>] \
  [--template-id <template-id>] \
  [--rules-file <path-to-json>]

Create a Firewall Group. Either start from a template (--template-id web-server), pass rules as JSON via --rules-file, or both (rules merge with template). Rule format follows the Create Firewall API schema:

[
  { "protocol": "TCP", "rule_type": "INBOUND", "range": "22", "ip": "0.0.0.0", "size": "0" },
  { "protocol": "TCP", "rule_type": "INBOUND", "range": "80,443", "ip": "0.0.0.0", "size": "0" },
  { "protocol": "ALL", "rule_type": "OUTBOUND" }
]

Maximum 40 inbound rules + 40 outbound rules per group. The system Default Firewall blocks TCP 135/139/445/5985–5986 and UDP 137–138 — those are stripped from any rule range you submit.

delete

raff security-group delete <sg-id>

Delete a Firewall Group. Fails if it’s still attached to any VM — detach with raff vm sg remove on each VM first.

When changes apply

Changes apply to running VMs with no reboot: saved rules within a few seconds, an attach or detach in about 20 seconds. Connections already open stay open; new connections follow the new rules. See Update rules.

VM commands

raff vm sg add to attach to a VM.

Firewall overview

The two-layer firewall model.

Inbound vs outbound

Rule format, port ranges, CIDR.

Getting Started

Guides

REST API

CLI

Terraform

raff security-group

Subcommand index

list

templates

get

create

delete

When changes apply

VM commands

Firewall overview

Inbound vs outbound

​Subcommand index

​list

​templates

​get

​create

​delete

​When changes apply

​Related

VM commands

Firewall overview

Inbound vs outbound

Subcommand index

list

templates

get

create

delete

When changes apply

Related