# Ensure network security group restricts ingress from 0.0.0.0/0 to port 22 (SSH)

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698520046229-ensure-network-security-group-restricts-ingress-from-00000-to-port-22-ssh
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure no network security group rule allows inbound traffic from 0.0.0.0/0 (any IPv4 address on the internet) to TCP port 22, which is used for SSH remote login to Linux instances. Remote administration should come only from trusted IP ranges or through the OCI Bastion service.

**Rationale**

Port 22 open to the whole internet is constantly scanned by attackers, who try password guessing and known exploits against SSH. A single weak password or unpatched service can then give an attacker control of the instance. Limiting SSH to trusted networks, or using OCI Bastion instead, removes this exposure while still allowing administrators to connect.

**Impact**

-   Blocks SSH access from the public internet
    
-   Reduces brute-force and exploit attempts
    
-   Administrators must connect from trusted IP ranges or through OCI Bastion
    

**Default Value**

By default, a new network security group has no ingress rules.

**Pre-Requisites**

-   Permission to manage virtual-network-family in the compartment
    
-   A list of trusted IP ranges that need SSH access, or an OCI Bastion set up
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.
    
3.  Open the Security tab (or Network Security Groups under Resources on some consoles) and select the network security group.
    
4.  Review the ingress rules and look for any rule with source 0.0.0.0/0 that allows TCP port 22, or all protocols or all ports.
    
5.  Repeat for every network security group in each VCN.
    
6.  If any such rule is found, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.
    
3.  Open the Security tab (or Network Security Groups under Resources on some consoles) and select the network security group.
    
4.  Find the ingress rule that allows 0.0.0.0/0 to port 22.
    
5.  Select Edit on the rule and change the source CIDR to a trusted IP range, or delete the rule.
    
6.  Save the changes.
    
7.  Confirm that administrators can still connect from trusted networks or through OCI Bastion.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.
    
3.  Open the Security tab (or Network Security Groups under Resources on some consoles) and select the network security group.
    
4.  Add back the previous ingress rule (source 0.0.0.0/0, TCP destination port 22) and save.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/networksecuritygroups.htm](https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/networksecuritygroups.htm)
    
-   [https://docs.oracle.com/en-us/iaas/Content/Bastion/Concepts/bastionoverview.htm](https://docs.oracle.com/en-us/iaas/Content/Bastion/Concepts/bastionoverview.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.