Opening Ports with firewalld

Opening Ports with firewalld - 图1danger

Enabling firewalld can cause serious network communication problems.

For proper network function, firewalld must be disabled on systems running RKE2. Firewalld conflicts with Canal, RKE2’s default networking stack.

Firewalld must also be disabled on systems running Kubernetes 1.19 and later.

If you enable firewalld on systems running Kubernetes 1.18 or earlier, understand that this may cause networking issues. CNIs in Kubernetes dynamically update iptables and networking rules independently of any external firewalls, such as firewalld. This can cause unexpected behavior when the CNI and the external firewall conflict.

Some distributions of Linux derived from RHEL, including Oracle Linux, may have default firewall rules that block communication with Helm.

For example, one Oracle Linux image in AWS has REJECT rules that stop Helm from communicating with Tiller:

  1. Chain INPUT (policy ACCEPT)
  2. target     prot opt source               destination
  3. ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
  4. ACCEPT     icmp --  anywhere             anywhere
  5. ACCEPT     all  --  anywhere             anywhere
  6. ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
  7. REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited
  9. Chain FORWARD (policy ACCEPT)
  10. target     prot opt source               destination
  11. REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited
  13. Chain OUTPUT (policy ACCEPT)
  14. target     prot opt source               destination

You can check the default firewall rules with this command:

  1. sudo iptables --list

This section describes how to use firewalld to apply the firewall port rules for nodes in a high-availability Rancher server cluster.

Prerequisite

Install v7.x or later ofvfirewalld:

  1. yum install firewalld
  2. systemctl start firewalld
  3. systemctl enable firewalld

Applying Firewall Port Rules

In the Rancher high-availability installation instructions, the Rancher server is set up on three nodes that have all three Kubernetes roles: etcd, controlplane, and worker. If your Rancher server nodes have all three roles, run the following commands on each node:

  1. firewall-cmd --permanent --add-port=22/tcp
  2. firewall-cmd --permanent --add-port=80/tcp
  3. firewall-cmd --permanent --add-port=443/tcp
  4. firewall-cmd --permanent --add-port=2376/tcp
  5. firewall-cmd --permanent --add-port=2379/tcp
  6. firewall-cmd --permanent --add-port=2380/tcp
  7. firewall-cmd --permanent --add-port=6443/tcp
  8. firewall-cmd --permanent --add-port=8472/udp
  9. firewall-cmd --permanent --add-port=9099/tcp
  10. firewall-cmd --permanent --add-port=10250/tcp
  11. firewall-cmd --permanent --add-port=10254/tcp
  12. firewall-cmd --permanent --add-port=30000-32767/tcp
  13. firewall-cmd --permanent --add-port=30000-32767/udp

If your Rancher server nodes have separate roles, use the following commands based on the role of the node:

  1. # For etcd nodes, run the following commands:
  2. firewall-cmd --permanent --add-port=2376/tcp
  3. firewall-cmd --permanent --add-port=2379/tcp
  4. firewall-cmd --permanent --add-port=2380/tcp
  5. firewall-cmd --permanent --add-port=8472/udp
  6. firewall-cmd --permanent --add-port=9099/tcp
  7. firewall-cmd --permanent --add-port=10250/tcp
  9. # For control plane nodes, run the following commands:
  10. firewall-cmd --permanent --add-port=80/tcp
  11. firewall-cmd --permanent --add-port=443/tcp
  12. firewall-cmd --permanent --add-port=2376/tcp
  13. firewall-cmd --permanent --add-port=6443/tcp
  14. firewall-cmd --permanent --add-port=8472/udp
  15. firewall-cmd --permanent --add-port=9099/tcp
  16. firewall-cmd --permanent --add-port=10250/tcp
  17. firewall-cmd --permanent --add-port=10254/tcp
  18. firewall-cmd --permanent --add-port=30000-32767/tcp
  19. firewall-cmd --permanent --add-port=30000-32767/udp
  21. # For worker nodes, run the following commands:
  22. firewall-cmd --permanent --add-port=22/tcp
  23. firewall-cmd --permanent --add-port=80/tcp
  24. firewall-cmd --permanent --add-port=443/tcp
  25. firewall-cmd --permanent --add-port=2376/tcp
  26. firewall-cmd --permanent --add-port=8472/udp
  27. firewall-cmd --permanent --add-port=9099/tcp
  28. firewall-cmd --permanent --add-port=10250/tcp
  29. firewall-cmd --permanent --add-port=10254/tcp
  30. firewall-cmd --permanent --add-port=30000-32767/tcp
  31. firewall-cmd --permanent --add-port=30000-32767/udp

After the firewall-cmd commands have been run on a node, use the following command to enable the firewall rules:

  1. firewall-cmd --reload

Result: The firewall is updated so that Helm can communicate with the Rancher server nodes.