Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

Chapter 2. Using a firewall

Firewalls are not required in Red Hat build of MicroShift, but using a firewall can prevent undesired access to the Red Hat build of MicroShift API.

2.1. About network traffic through the firewall
링크 복사

When using a firewall, you must explicitly allow the following OVN-Kubernetes traffic when the firewalld service is running:

CNI pod to CNI pod
CNI pod to Host-Network pod Host-Network pod to Host-Network pod
CNI pod
The Kubernetes pod that uses the CNI network
Host-Network pod
The Kubernetes pod that uses host network Install and configure the firewalld service by using the following procedures.
Important

Red Hat build of MicroShift pods must have access to the internal CoreDNS component and API servers.

2.2. Installing the firewalld service
링크 복사

Use the following procedure to install and run the firewalld service for Red Hat build of MicroShift.

Procedure

  1. To install the firewalld service, run the following command: 

    $ sudo dnf install -y firewalld
    Copy to Clipboard Toggle word wrap

  2. To initiate the firewall, run the following command: 

    $ sudo systemctl enable firewalld --now
    Copy to Clipboard Toggle word wrap

2.3. Required firewall settings
링크 복사

An IP address range for the cluster network must be enabled during firewall configuration. You can use the default values or customize the IP address range. If you choose to customize the cluster network IP address range from the default 10.42.0.0/16 setting, you must also use the same custom range in the firewall configuration.

Expand
Table 2.1. Firewall IP address settings
IP RangeFirewall rule requiredDescription

10.42.0.0/16

No

Host network pod access to other pods

169.254.169.1

Yes

Host network pod access to Red Hat build of MicroShift API server

The following are examples of commands for settings that are mandatory for firewall configuration:

Example commands

  • Configure host network pod access to other pods: 

    $ sudo firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16
    Copy to Clipboard Toggle word wrap

  • Configure host network pod access to services backed by Host endpoints, such as the Red Hat build of MicroShift API: 

    $ sudo firewall-cmd --permanent --zone=trusted --add-source=169.254.169.1
    Copy to Clipboard Toggle word wrap

2.4. Using optional port settings
링크 복사

The Red Hat build of MicroShift firewall service allows optional port settings.

Procedure

  • To add customized ports to your firewall configuration, use the following command syntax: 

    $ sudo firewall-cmd --permanent --zone=public --add-port=<port number>/<port protocol>
    Copy to Clipboard Toggle word wrap
    Expand
    Table 2.2. Optional ports
    Port(s)Protocol(s)Description

    80

    TCP

    HTTP port used to serve applications through the OpenShift Container Platform router.

    443

    TCP

    HTTPS port used to serve applications through the OpenShift Container Platform router.

    5353

    UDP

    mDNS service to respond for OpenShift Container Platform route mDNS hosts.

    30000-32767

    TCP

    Port range reserved for NodePort services; can be used to expose applications on the LAN.

    30000-32767

    UDP

    Port range reserved for NodePort services; can be used to expose applications on the LAN.

    6443

    TCP

    HTTPS API port for the Red Hat build of MicroShift API.

The following are examples of commands used when requiring external access through the firewall to services running on Red Hat build of MicroShift, such as port 6443 for the API server, for example, ports 80 and 443 for applications exposed through the router.

Example commands

  • Configuring a port for the Red Hat build of MicroShift API server: 

    $ sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp
    Copy to Clipboard Toggle word wrap

  • Configuring ports for applications exposed through the router: 

    $ sudo firewall-cmd --permanent --zone=public --add-port=80/tcp
    Copy to Clipboard Toggle word wrap 
    $ sudo firewall-cmd --permanent --zone=public --add-port=443/tcp
    Copy to Clipboard Toggle word wrap

2.5. Allowing network traffic through the firewall
링크 복사

You can allow network traffic through the firewall by first configuring the IP address range with either default or custom values, and then allow internal traffic from pods through the network gateway by inserting the DNS server.

Procedure

Set the default values or a custom IP address range. After setting the IP address range, allow internal traffic from the pods through the network gateway.

  1. To set the IP address range:

    1. To configure the IP address range with default values, run the following command: 

      $ sudo firewall-offline-cmd --permanent --zone=trusted --add-source=10.42.0.0/16
      Copy to Clipboard Toggle word wrap

    2. Alternatively, you can configure the IP address range with custom values by running the following command: 

      $ sudo firewall-offline-cmd --permanent --zone=trusted --add-source=<custom IP range>
      Copy to Clipboard Toggle word wrap

  2. To allow internal traffic from pods through the network gateway, run the following command: 

    $ sudo firewall-offline-cmd --permanent --zone=trusted --add-source=169.254.169.1
    Copy to Clipboard Toggle word wrap

2.5.1. Applying firewall settings
링크 복사

To apply firewall settings, use the following one-step procedure:

Procedure

After you have finished configuring network access through the firewall, run the following command to restart the firewall and apply settings: 

$ sudo firewall-cmd --reload
Copy to Clipboard Toggle word wrap

2.6. Verifying firewall settings
링크 복사

After you have restarted the firewall, you can verify your settings by listing them.

Procedure

  • To verify rules added in the default public zone, such as ports-related rules, run the following command: 

    $ sudo firewall-cmd --list-all
    Copy to Clipboard Toggle word wrap

  • To verify rules added in the trusted zone, such as IP-range related rules, run the following command: 

    $ sudo firewall-cmd --zone=trusted --list-all
    Copy to Clipboard Toggle word wrap

2.7. Known firewall issue
링크 복사

  • To avoid breaking traffic flows with a firewall reload or restart, execute firewall commands before starting Red Hat build of MicroShift. The CNI driver in Red Hat build of MicroShift makes use of iptable rules for some traffic flows, such as those using the NodePort service. The iptable rules are generated and inserted by the CNI driver, but are deleted when the firewall reloads or restarts. The absence of the iptable rules breaks traffic flows. If firewall commands have to be executed after Red Hat build of MicroShift is running, manually restart ovnkube-master pod in the openshift-ovn-kubernetes namespace to reset the rules controlled by the CNI driver.
맨 위로 이동
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

Theme

© 2025 Red Hat