diff --git a/pkg/compute/models/guests.go b/pkg/compute/models/guests.go
index 3d07b10bfa..4839c19d24 100644
--- a/pkg/compute/models/guests.go
+++ b/pkg/compute/models/guests.go
@@ -1296,7 +1296,7 @@ func (self *SGuest) GetSecRules() []secrules.SecurityRule {
 
 func (self *SGuest) getSecRules() []secrules.SecurityRule {
 	if secgrp := self.getSecgroup(); secgrp != nil {
-		return secgrp.getSecRules()
+		return secgrp.getSecRules("")
 	}
 	if rule, err := secrules.ParseSecurityRule(options.Options.DefaultSecurityRules); err == nil {
 		return []secrules.SecurityRule{*rule}
@@ -1309,7 +1309,7 @@ func (self *SGuest) getSecRules() []secrules.SecurityRule {
 func (self *SGuest) getSecurityRules() string {
 	secgrp := self.getSecgroup()
 	if secgrp != nil {
-		return secgrp.getSecurityRuleString()
+		return secgrp.getSecurityRuleString("")
 	} else {
 		return options.Options.DefaultSecurityRules
 	}
@@ -1318,7 +1318,7 @@ func (self *SGuest) getSecurityRules() string {
 func (self *SGuest) getAdminSecurityRules() string {
 	secgrp := self.getAdminSecgroup()
 	if secgrp != nil {
-		return secgrp.getSecurityRuleString()
+		return secgrp.getSecurityRuleString("")
 	} else {
 		return options.Options.DefaultAdminSecurityRules
 	}
@@ -3438,7 +3438,7 @@ func (self *SGuest) GetJsonDescAtHypervisor(ctx context.Context, host *SHost) *j
 		srs := self.getSecurityRuleSet()
 		if srs.estimatedSinglePortRuleCount() <= options.FirewallFlowCountLimit {
 	*/
-	
+
 	rules := self.getSecurityRules()
 	if len(rules) > 0 {
 		desc.Add(jsonutils.NewString(rules), "security_rules")
diff --git a/pkg/compute/models/secgroups.go b/pkg/compute/models/secgroups.go
index 82b8557960..b407cab27e 100644
--- a/pkg/compute/models/secgroups.go
+++ b/pkg/compute/models/secgroups.go
@@ -10,6 +10,7 @@ import (
 	"yunion.io/x/log"
 	"yunion.io/x/pkg/util/compare"
 	"yunion.io/x/pkg/util/secrules"
+	"yunion.io/x/pkg/utils"
 	"yunion.io/x/sqlchemy"
 
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
@@ -64,7 +65,7 @@ func (self *SSecurityGroup) GetGuests() []SGuest {
 func (self *SSecurityGroup) GetExtraDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict {
 	extra := self.SSharableVirtualResourceBase.GetExtraDetails(ctx, userCred, query)
 	extra.Add(jsonutils.NewInt(int64(len(self.GetGuests()))), "guest_cnt")
-	extra.Add(jsonutils.NewString(self.getSecurityRuleString()), "rules")
+	extra.Add(jsonutils.NewString(self.getSecurityRuleString("")), "rules")
 	return extra
 }
 
@@ -73,6 +74,8 @@ func (self *SSecurityGroup) GetCustomizeColumns(ctx context.Context, userCred mc
 	extra.Add(jsonutils.NewInt(int64(len(self.GetGuests()))), "guest_cnt")
 	extra.Add(jsonutils.NewTimeString(self.CreatedAt), "created_at")
 	extra.Add(jsonutils.NewString(self.Description), "description")
+	extra.Add(jsonutils.NewString(self.getSecurityRuleString("in")), "in_rules")
+	extra.Add(jsonutils.NewString(self.getSecurityRuleString("out")), "out_rules")
 	return extra
 }
 
@@ -97,9 +100,12 @@ func (manager *SSecurityGroupManager) FetchSecgroupById(secId string) *SSecurity
 	return nil
 }
 
-func (self *SSecurityGroup) getSecurityRules() (rules []SSecurityGroupRule) {
+func (self *SSecurityGroup) getSecurityRules(direction string) (rules []SSecurityGroupRule) {
 	secgrouprules := SecurityGroupRuleManager.Query().SubQuery()
-	sql := secgrouprules.Query().Filter(sqlchemy.Equals(secgrouprules.Field("secgroup_id"), self.Id))
+	sql := secgrouprules.Query().Filter(sqlchemy.Equals(secgrouprules.Field("secgroup_id"), self.Id)).Desc("priority")
+	if len(direction) > 0 && utils.IsInStringArray(direction, []string{"in", "out"}) {
+		sql = sql.Equals("direction", direction)
+	}
 	if err := db.FetchModelObjects(SecurityGroupRuleManager, sql, &rules); err != nil {
 		log.Errorf("GetGuests fail %s", err)
 		return
@@ -107,9 +113,9 @@ func (self *SSecurityGroup) getSecurityRules() (rules []SSecurityGroupRule) {
 	return
 }
 
-func (self *SSecurityGroup) getSecRules() []secrules.SecurityRule {
+func (self *SSecurityGroup) getSecRules(direction string) []secrules.SecurityRule {
 	rules := make([]secrules.SecurityRule, 0)
-	for _, _rule := range self.getSecurityRules() {
+	for _, _rule := range self.getSecurityRules(direction) {
 		singleRules, err := _rule.SingleRules()
 		if err != nil {
 			log.Errorf(err.Error())
@@ -119,8 +125,8 @@ func (self *SSecurityGroup) getSecRules() []secrules.SecurityRule {
 	return rules
 }
 
-func (self *SSecurityGroup) getSecurityRuleString() string {
-	secgrouprules := self.getSecurityRules()
+func (self *SSecurityGroup) getSecurityRuleString(direction string) string {
+	secgrouprules := self.getSecurityRules(direction)
 	var rules []string
 	for _, rule := range secgrouprules {
 		rules = append(rules, rule.String())
@@ -158,7 +164,7 @@ func (self *SSecurityGroup) PerformClone(ctx context.Context, userCred mcclient.
 		return nil, err
 		//db.OpsLog.LogCloneEvent(self, secgroup, userCred, nil)
 	}
-	secgrouprules := self.getSecurityRules()
+	secgrouprules := self.getSecurityRules("")
 	for _, rule := range secgrouprules {
 		secgrouprule := &SSecurityGroupRule{}
 		secgrouprule.SetModelManager(SecurityGroupRuleManager)
diff --git a/pkg/mcclient/modules/mod_secgroups.go b/pkg/mcclient/modules/mod_secgroups.go
index 78dbaacae0..7208a5bcb4 100644
--- a/pkg/mcclient/modules/mod_secgroups.go
+++ b/pkg/mcclient/modules/mod_secgroups.go
@@ -8,7 +8,7 @@ func init() {
 	SecGroups = NewComputeManager("secgroup", "secgroups",
 		[]string{"ID", "Name", "Rules",
 			"Is_public", "Created_at",
-			"Guest_cnt", "Description"},
+			"Guest_cnt", "Description", "in_rules", "out_rules"},
 		[]string{})
 
 	registerCompute(&SecGroups)