Nova instances on Neutron networks: can the default security group be trusted to block accidental public access?
Context We run Nova compute instances attached to Neutron networks, with floating IPs allocated on demand. The goal is a defensible baseline where no instance becomes reachable from the public internet unless an operator deliberately opens a specific port. Uncertainty Neutron applies security groups as stateful, allow-only filters on each VM port, and the au
openstack