Security Groupshigh

• AWS stateful auto-response.
• OpenStack stateless explicit.
• OpenStack port/project.
• AWS default inbound deny/outbound all.

Network Security Groups (NSGs)high

• NSGs can associate to both subnets and NICs with specific processing order (inbound: subnet then NIC; outbound: NIC then subnet) ().
• Stateful with priority-based rules (100-4096); augmented rules allow multiple IPs/ports per rule (Resource Manager only).
• Default rules allow VNet/LB/Internet out; service tags like VirtualNetwork.
• No direct port-level only like OpenStack; subnet-level affects all instances.

Cloud Firewallshigh

• Application model: DigitalOcean firewalls are applied to Droplets via `droplet_ids` and/or tags, whereas OpenStack security groups are typically attached to Neutron ports (VM NICs) and can vary per port ().
• Rule model includes both inbound and outbound rules and notes that if none are configured then no traffic is permitted in that direction; OpenStack security groups also support egress rules but many deployments default to allow-all egress—migrating users may need to explicitly model egress restrictions in DigitalOcean if they rely on different defaults ().
• Aggregation semantics: DigitalOcean states that when multiple cloud firewalls apply to a Droplet, rules are additive (“union of the rules”) and a more permissive rule in any firewall effectively opens access; OpenStack security groups are also generally additive, but users migrating from “deny-by-default with explicit groups” patterns may be surprised by how quickly access broadens when stacking policies ().
• Target/source object types differ: DigitalOcean allows sources/destinations to include load balancers (by UID) and uses constructs like `load_balancer_uids`, `droplet_ids`, `tags`, and CIDRs in rule JSON, whereas OpenStack security group rules typically reference CIDRs and/or remote security group IDs (not load balancer UIDs as a primitive) ().

Firewall Ruleshigh

• GCP firewall rules are VPC-level with target filtering by network tags or service accounts; OpenStack security groups attach to ports.
• GCP rules are stateful (implied return traffic); OpenStack security groups also stateful but per Neutron port.
• GCP firewall supports priority (0-65535) with explicit deny rules; OpenStack security groups are allow-only (implicit deny).
• GCP hierarchical firewall policies apply org/folder-wide; OpenStack has no equivalent scope.

Firewallshigh

• Applies only to Cloud Servers (not Load Balancers), up to 5/server, 500 rules max; free ().
• Default: inbound blocked, outbound allowed; uses label selectors for auto-apply; statefulness not specified but likely stateless given rules ().
• No per-port/per-network granularity like Neutron SG rules; connection limits (80k concurrent/server) ().
• Custom Hetzner API vs Neutron security-groups API.