Nothing reaches the server until you allow it.
A security group is the firewall on the instance. New VMs start with no inbound access from the Internet: no SSH, no ping, no HTTP. Attach a group that allows the traffic you need, or the server can show Active with no way in. Create the group here, then attach it when you launch in Creating and Managing Virtual Machines, or on the server page after.
From Cloud → Networking, open the Security Groups tab. Click + Create Security Group.
If this project already has a group with inbound SSH, skip create and open that group instead. The screens below use one named SSH.
Open the group. Under Security Group Rules, click + Add rule. For SSH you want inbound TCP port 22. The SSH group already has that rule:
Read the row: ingress, IPv4, port 22, protocol tcp, remote 0.0.0.0/0. That CIDR is the whole Internet. Tighten it to your office prefix if you can. The two egress Any rows are normal; leave them unless you mean to lock outbound traffic.
On the create-server form, attach this group before + Create Server. That step lives in Creating and Managing Virtual Machines.
If the server already exists: Cloud → Servers, click the name, Security Groups, then Add Security Group and pick the group. Here SSH is already on demo-ubuntu.
Same + Add rule screen. Direction ingress, ether type IPv4, remote 0.0.0.0/0 unless you have a tighter CIDR.
Some people put every rule in one group. Others keep small groups (SSH, web) and attach several. No performance difference. Small groups are easier to audit later. Do not treat default as inbound SSH from the Internet. It is not.
