diff --git a/ansible/playbooks/openstack-security-groups.yml b/ansible/playbooks/openstack-security-groups.yml
new file mode 100644
index 0000000..f803bab
--- /dev/null
+++ b/ansible/playbooks/openstack-security-groups.yml
@@ -0,0 +1,62 @@
+---
+- hosts: localhost
+  vars_files:
+    - ../vars/common.yml
+
+  tasks:
+  - name: Load variables (Standard vs protected)
+    include_vars:
+      file: ../vars/{{ project_zone }}.yml
+
+  - name: Create security groups
+    os_security_group:
+      cloud: "{{ os_project }}"
+      state: "{{ state }}"
+      name: "{{ item }}"
+    with_items: "{{ security_groups }}"
+
+  - name: Remove default egress rules (protected only)
+    os_security_group:
+      cloud: "{{ os_project }}"
+      state: "{{ state }}"
+      name: "{{ item }}"
+      security_group_rules: []
+    with_items: "{{ security_groups }}"
+    when: project_zone == "protected"
+
+  - name: Set remote group rules for security groups
+    os_security_group_rule:
+      cloud: "{{ os_project }}"
+      state: "{{ state }}"
+      description: "{{ rule.comment }}"
+      direction: "{{ rule.direction }}"
+      security_group: "{{ rule.group }}"
+      remote_group: "{{ rule.remote_group }}"
+      protocol: "{{ rule.protocol }}"
+      port_range_min: "{{ rule.port_min }}"
+      port_range_max: "{{ rule.port_max }}"
+      ethertype: IPv4
+    loop: "{{ remote_group_rules }}"
+    loop_control:
+      loop_var: rule
+
+  - name: Set remote IP rules for security groups
+    os_security_group_rule:
+      cloud: "{{ os_project }}"
+      state: "{{ state }}"
+      description: "{{ rule.comment }}"
+      direction: "{{ rule.direction }}"
+      security_group: "{{ rule.group }}"
+      remote_ip_prefix: "{{ rule.remote_ip }}"
+      protocol: "{{ rule.protocol }}"
+      port_range_min: "{{ rule.port_min }}"
+      port_range_max: "{{ rule.port_max }}"
+      ethertype: IPv4
+    loop: "{{ remote_ip_rules }}"
+    loop_control:
+      loop_var: rule
+
+# 1 task to create groups for default egress
+# 1 task to create rules that are only for ingress
+# maybe use common rules/vars better
+# default egress maybe disabled on clients even on standard (add rules)