---
title: How to enable or disable SSH ports on Kubernetes Kapsule cluster nodes
description: This page explains how to enable or disable SSH ports on Kubernetes Kapsule cluster nodes.
tags: kubernetes kapsule-cluster
dates:
  validation: 2025-07-15
  posted: 2023-05-02
---
import Requirements from '@macros/iam/requirements.mdx'


Kubernetes Kapsule clusters are provisioned with a default security group as standard. Clusters deployed prior to May 2023 allow inbound traffic to the nodes.<br /><br />
Since May 2023, each Kapsule cluster comes with a default security group implementing an inbound `DROP ALL` policy, effectively blocking all incoming connections by default.<br /><br />
To activate the preinstalled SSH server for node access within the cluster, it is necessary to manually [configure a custom rule](/instances/how-to/use-security-groups/#how-to-edit-a-security-group) in the cluster's security group to allow inbound traffic on TCP port 22.

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- [Created](/kubernetes/how-to/create-cluster/) a Kubernetes Kapsule cluster

1. Click **CPU & GPU Instances** in the side menu, then click **Security groups** to view the [security group](https://console.scaleway.com/instance/security-groups) section in your Scaleway console.
2. Click <Icon name="more"/> next to the security group you intend to configure and choose **More info**. The security group's overview displays.
    <Message type="tip">
      Alternatively, you can also select the security group's name. The security group's overview displays.
    </Message>
3. Access the **Rules** tab to view the security group rules.
4. In the **Rules** section of the security group, click <Icon name="edit" /> to edit the rules.
5. Configure a new custom inbound rule:
    * Rule: accept
    * Protocol: TCP
    * Port: 22 (standard SSH port)
    * IP range: Specify a CIDR IP range authorized for connection to your Instance. As an option, select **All IPs** to allow connections from any IP. It is recommended to restrict access to your rule to a limited IP range for maximum security.
6. Click <Icon name="validate" /> to validate the security group configuration.