5.2. Network Access
The components of an OpenShift Enterprise deployment require network access to connect with one another. The deployment methods described in this guide set up a basic
iptables firewall configuration by default to enable network access. If your environment requires a custom or external firewall solution, the configuration must accommodate the port requirements of OpenShift Enterprise.
5.2.1. Custom and External Firewalls
If you use a custom firewall configuration, consult the following table for details on the ports to which OpenShift Enterprise components require access. The table includes all ports with external interfaces or connections between hosts. It does not include the loopback interface. Some ports are optional depending on your OpenShift Enterprise configuration and usage.
Application developers and application users require access to ports marked
public in the Direction column. Ensure the firewall exposes these ports publicly.
Further details on configuring an external firewall solution for use with OpenShift Enterprise are beyond the scope of this guide. Consult your network administrator for more information.
| Host | Port | Protocol | Direction | Use |
|---|---|---|---|---|
| All | 22 | TCP | Inbound internal network | Remote administration. |
| All | 53 | TCP/UDP | Outbound to nameserver | Name resolution. |
| Broker | 22 | TCP | Outbound to node hosts | rsync access to gears for moving gears between nodes. |
| Broker | 80 | TCP | Inbound public traffic |
HTTP access. HTTP requests to port 80 are redirected to HTTPS on port 443.
|
| Broker | 443 | TCP | Inbound public traffic |
HTTPS access to the broker REST API by
rhc and Eclipse integration. HTTPS access to the Management Console.
|
| Broker | 27017 | TCP | Outbound to datastore host. | Optional if the same host has both the broker and datastore components. |
| Broker | 61613 | TCP | Outbound to ActiveMQ hosts |
ActiveMQ connections to communicate with node hosts.
|
| Node | 22 | TCP | Inbound public traffic |
Developers running
git push to their gears. Developer remote administration on their gears.
|
| Node | 80 | TCP | Inbound public traffic | HTTP requests to applications hosted on OpenShift Enterprise. |
| Node | 443 | TCP | Inbound public traffic | HTTPS requests to applications hosted on OpenShift Enterprise. |
| Node | 8000 | TCP | Inbound public traffic |
WebSocket connections to applications hosted on OpenShift Enterprise. Optional if you are not using WebSockets.
|
| Node | 8443 | TCP | Inbound public traffic |
Secure WebSocket connections to applications hosted on OpenShift Enterprise. Optional if you are not using secure WebSockets.
|
| Node | 2303 - 2308 [a] | TCP | Inbound public traffic |
Gear access through the SNI proxy. Optional if you are not using the SNI proxy.
|
| Node | 443 | TCP | Outbound to broker hosts | REST API calls to broker hosts. |
| Node | 35531 - 65535 [b] | TCP | Inbound public traffic |
Gear access through the
port-proxy service. Optional unless applications need to expose external ports in addition to the front-end proxies.
|
| Node | 35531 - 65535 [b] | TCP | Inbound/outbound with other node hosts |
Communications between cartridges running on separate gears.
|
| Node | 61613 | TCP | Outbound to ActiveMQ hosts | ActiveMQ connections to communicate with broker hosts. |
| ActiveMQ | 61613 | TCP | Inbound from broker and node hosts | Broker and node host connections to ActiveMQ. |
| ActiveMQ | 61616 | TCP | Inbound/outbound with other ActiveMQ brokers |
Communications between ActiveMQ hosts. Optional if no redundant ActiveMQ hosts exist.
|
| Datastore | 27017 | TCP | Inbound from broker hosts |
Broker host connections to MongoDB. Optional if the same host has both the broker and datastore components.
|
| Datastore | 27017 | TCP | Inbound/outbound with other MongoDB hosts |
Replication between datastore hosts. Optional if no redundant datastore hosts exist.
|
| Nameserver | 53 | TCP/UDP | Inbound from broker hosts | Publishing DNS updates. |
| Nameserver | 53 | TCP/UDP | Inbound public traffic | Name resolution for applications hosted on OpenShift Enterprise. |
| Nameserver | 53 | TCP/UDP | Outbound public traffic |
DNS forwarding. Optional unless the nameserver is recursively forwarding requests to other nameservers.
|
[a]
Note: The size and location of these SNI port range are configurable.
[b]
Note: If the value of PROXY_BEGIN in the /etc/openshift/node.conf file changes from 35531, adjust this port range accordingly.
| ||||
