[Yandex Cloud documentation](../../index.md) > [Yandex Data Processing](../index.md) > [Step-by-step guides](index.md) > Yandex Data Processing clusters > Connection > Configuring security groups

# Configuring security groups

Cluster access depends on the security group configuration. Make sure the rules allow the required traffic.

{% note alert %}

When setting up security groups, do not change the [rules for control plane traffic](cluster-create.md#change-security-groups). This may cause the cluster to fail.

{% endnote %}

Rule settings depends on the connection method you select:

{% list tabs %}

- SSH

    * To connect to subcluster hosts with public access from cloud networks and the internet, [configure cluster security groups](../../vpc/operations/security-group-add-rule.md) to allow inbound traffic from any IP address on port `22`. To do this, create the following inbound rule:

      * **Port range**: `22`.
      * **Protocol**: `TCP`.
      * **Source**: `Address range`.
      * **IPv4 CIDR**: `0.0.0.0/0`.

    * To connect to a cluster from a jump host VM:

      1. [Configure](../../vpc/operations/security-group-add-rule.md) the VM security group to allow connections to the VM and traffic between the VM and subcluster hosts. To do this, create the following rules:

          * For inbound traffic:

              * **Port range**: `22`.
              * **Protocol**: `TCP`.
              * **Source**: `Address range`.
              * **IPv4 CIDR**: `0.0.0.0/0`.

          * For outbound traffic:

              * **Port range**: `22`.
              * **Protocol**: `TCP`.
              * **Destination name**: `Address range`.
              * **IPv4 CIDR**: Address range of the subnet where the cluster hosts reside. If subclusters are in different subnets, create this rule for each subnet.

      1. [Configure the cluster security](../../vpc/operations/security-group-add-rule.md) groups to allow inbound traffic from the VM security group on port `22`. To do this, create the following rule for inbound traffic:

          * **Port range**: `22`.
          * **Protocol**: `TCP`.
          * **Source**: `Security group`.
          * **Security group**: VM security group.

- UI Proxy

    To use [**UI Proxy**](../concepts/interfaces.md), [add](../../vpc/operations/security-group-add-rule.md) rules to the subcluster host's security group to allow inbound traffic on port `443`:

    * **Port range**: `443`.
    * **Protocol**: `TCP`.
    * **Source**: `Address range`.
    * **IPv4 CIDR**: `0.0.0.0/0`.

    If the connection is established via a jump host VM, [add](../../vpc/operations/security-group-add-rule.md) rules to the subcluster host's security group that allow connections via this VM:

    * For inbound traffic:

        * **Port range**: `443`.
        * **Protocol**: `TCP`.
        * **Source**: `Address range`.
        * **IPv4 CIDR**: `0.0.0.0/0`.

    * For outbound traffic:

        * **Port range**: `443`.
        * **Protocol**: `TCP`.
        * **Destination name**: `Address range`.
        * **IPv4 CIDR**: Address range of the subnet where the subcluster host resides.

- Connecting with port forwarding

    If using [port forwarding](connect-interfaces.md#routing), [add](../../vpc/operations/security-group-add-rule.md) rules to the jump host VM security group that allow inbound and outbound traffic on the ports of the required components:

    * **Port range**: `<component_port>`.

        Port numbers for the Yandex Data Processing components are shown in the table:

        | Service                        | Port  |
        | ----------------------------- | ----- |
        | HBase Master                  | 16010 |
        | HBase REST                    |  8085 |
        | HDFS Name Node                |  9870 |
        | Hive Server2                  | 10002 |
        | Livy                          |  8998 |
        | MapReduce Application History | 19888 |
        | Oozie                         | 11000 |
        | Spark History                 | 18080 |
        | YARN Application History      |  8188 |
        | YARN Resource Manager         |  8088 |
        | Zeppelin                      |  8890 |

    * **Protocol**: `TCP`.
    * **Source**: `Address range`.
    * **IPv4 CIDR**: `0.0.0.0/0`.

{% endlist %}

{% note info %}

You can specify more granular rules for your security groups, such as allowing traffic only within specific subnets.

Make sure to properly configure security groups for all subnets where the subclusters will reside.

{% endnote %}

For more information about security groups, see [Security groups](../concepts/network.md#security-groups).