Opening Ports with firewalld

Opening Ports with firewalld - 图1danger

Enabling firewalld can cause serious network communication problems.

For proper network function, firewalld must be disabled on systems running RKE2. Firewalld conflicts with Canal, RKE2’s default networking stack.

Firewalld must also be disabled on systems running Kubernetes 1.19 and later.

If you enable firewalld on systems running Kubernetes 1.18 or earlier, understand that this may cause networking issues. CNIs in Kubernetes dynamically update iptables and networking rules independently of any external firewalls, such as firewalld. This can cause unexpected behavior when the CNI and the external firewall conflict.

Some distributions of Linux derived from RHEL, including Oracle Linux, may have default firewall rules that block communication with Helm.

For example, one Oracle Linux image in AWS has REJECT rules that stop Helm from communicating with Tiller:

  1. Chain INPUT (policy ACCEPT)
  2. target prot opt source destination
  3. ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
  4. ACCEPT icmp -- anywhere anywhere
  5. ACCEPT all -- anywhere anywhere
  6. ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
  7. REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
  8. Chain FORWARD (policy ACCEPT)
  9. target prot opt source destination
  10. REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
  11. Chain OUTPUT (policy ACCEPT)
  12. target prot opt source destination

You can check the default firewall rules with this command:

  1. sudo iptables --list

This section describes how to use firewalld to apply the firewall port rules for nodes in a high-availability Rancher server cluster.

Prerequisite

Install v7.x or later ofvfirewalld:

  1. yum install firewalld
  2. systemctl start firewalld
  3. systemctl enable firewalld

Applying Firewall Port Rules

In the Rancher high-availability installation instructions, the Rancher server is set up on three nodes that have all three Kubernetes roles: etcd, controlplane, and worker. If your Rancher server nodes have all three roles, run the following commands on each node:

  1. firewall-cmd --permanent --add-port=22/tcp
  2. firewall-cmd --permanent --add-port=80/tcp
  3. firewall-cmd --permanent --add-port=443/tcp
  4. firewall-cmd --permanent --add-port=2376/tcp
  5. firewall-cmd --permanent --add-port=2379/tcp
  6. firewall-cmd --permanent --add-port=2380/tcp
  7. firewall-cmd --permanent --add-port=6443/tcp
  8. firewall-cmd --permanent --add-port=8472/udp
  9. firewall-cmd --permanent --add-port=9099/tcp
  10. firewall-cmd --permanent --add-port=10250/tcp
  11. firewall-cmd --permanent --add-port=10254/tcp
  12. firewall-cmd --permanent --add-port=30000-32767/tcp
  13. firewall-cmd --permanent --add-port=30000-32767/udp

If your Rancher server nodes have separate roles, use the following commands based on the role of the node:

  1. # For etcd nodes, run the following commands:
  2. firewall-cmd --permanent --add-port=2376/tcp
  3. firewall-cmd --permanent --add-port=2379/tcp
  4. firewall-cmd --permanent --add-port=2380/tcp
  5. firewall-cmd --permanent --add-port=8472/udp
  6. firewall-cmd --permanent --add-port=9099/tcp
  7. firewall-cmd --permanent --add-port=10250/tcp
  8. # For control plane nodes, run the following commands:
  9. firewall-cmd --permanent --add-port=80/tcp
  10. firewall-cmd --permanent --add-port=443/tcp
  11. firewall-cmd --permanent --add-port=2376/tcp
  12. firewall-cmd --permanent --add-port=6443/tcp
  13. firewall-cmd --permanent --add-port=8472/udp
  14. firewall-cmd --permanent --add-port=9099/tcp
  15. firewall-cmd --permanent --add-port=10250/tcp
  16. firewall-cmd --permanent --add-port=10254/tcp
  17. firewall-cmd --permanent --add-port=30000-32767/tcp
  18. firewall-cmd --permanent --add-port=30000-32767/udp
  19. # For worker nodes, run the following commands:
  20. firewall-cmd --permanent --add-port=22/tcp
  21. firewall-cmd --permanent --add-port=80/tcp
  22. firewall-cmd --permanent --add-port=443/tcp
  23. firewall-cmd --permanent --add-port=2376/tcp
  24. firewall-cmd --permanent --add-port=8472/udp
  25. firewall-cmd --permanent --add-port=9099/tcp
  26. firewall-cmd --permanent --add-port=10250/tcp
  27. firewall-cmd --permanent --add-port=10254/tcp
  28. firewall-cmd --permanent --add-port=30000-32767/tcp
  29. firewall-cmd --permanent --add-port=30000-32767/udp

After the firewall-cmd commands have been run on a node, use the following command to enable the firewall rules:

  1. firewall-cmd --reload

Result: The firewall is updated so that Helm can communicate with the Rancher server nodes.