Interface groups for rule-based network security

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a network security appliance, cause the one or more processors to perform a method comprising:

• causing to be displayed a security rule configuration interface through which a network administrator can specify parameters of a plurality of security rules to be applied to network traffic attempting to traverse the network security appliance through one or more of a plurality of interfaces of the network security appliance;
• receiving via the security rule configuration interface information defining a traffic flow to be controlled by a security rule of the plurality security rules, wherein the information defining the traffic flow includes:
• a set of source interfaces of the plurality of interfaces, representing a proper subset of the plurality of interfaces, from which traffic associated with the traffic flow being defined may be received by the network security appliance;
• a set of destination interfaces of the plurality of interfaces, representing a proper subset of the plurality of interfaces, through which traffic associated with the traffic flow being defined may be transmitted by the network security appliance if the security rule allows the traffic flow;
• and
• wherein at least one of the set of source interfaces and the set of destination interfaces includes multiple interfaces of the plurality of interfaces such that the security rule permits the traffic flow to be defined in terms of multiple source interfaces or multiple destination interfaces;
• and
• receiving via the security rule configuration interface information regarding the action to be performed on the network traffic when the network traffic matches the security rule;
• storing the security rule as part of a ruleset to be applied to the network traffic.