Chapter 7. Using a firewall

Example commands

• Configure host network pod access to other pods:

  $ sudo firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16

  Copy to Clipboard Toggle word wrap

• Configure host network pod access to services backed by Host endpoints, such as the Red Hat build of MicroShift API:

  $ sudo firewall-cmd --permanent --zone=trusted --add-source=169.254.169.1

  Copy to Clipboard Toggle word wrap

Procedure

• To add customized ports to your firewall configuration, use the following command syntax:

  $ sudo firewall-cmd --permanent --zone=public --add-port=<port number>/<port protocol>

  Copy to Clipboard Toggle word wrap
  Expand

  Table 7.2. Optional ports

  Port(s)	Protocol(s)	Description
  80	TCP	HTTP port used to serve applications through the OpenShift Container Platform router.
  443	TCP	HTTPS port used to serve applications through the OpenShift Container Platform router.
  5353	UDP	mDNS service to respond for OpenShift Container Platform route mDNS hosts.
  30000-32767	TCP	Port range reserved for NodePort services; can be used to expose applications on the LAN.
  30000-32767	UDP	Port range reserved for NodePort services; can be used to expose applications on the LAN.
  6443	TCP	HTTPS API port for the Red Hat build of MicroShift API.

  Show more

Example command

• Configuring a port for the MicroShift API server:

  $ sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp

  Copy to Clipboard Toggle word wrap

Procedure

• To verify rules added in the default public zone, such as ports-related rules, run the following command:

  $ sudo firewall-cmd --list-all

  Copy to Clipboard Toggle word wrap

• To verify rules added in the trusted zone, such as IP-range related rules, run the following command:

  $ sudo firewall-cmd --zone=trusted --list-all

  Copy to Clipboard Toggle word wrap

• Services of the NodePort and LoadBalancer type are automatically available with OVN-Kubernetes.

  In these cases, OVN-Kubernetes adds iptables rules so the traffic to the node IP address is delivered to the relevant ports. This is done using the PREROUTING rule chain and is then forwarded to the OVN-K to bypass the firewalld rules for local host ports and services. Iptables and firewalld are backed by nftables in Red Hat Enterprise Linux (RHEL) 9. The nftables rules, which the iptables generates, always have priority over the rules that the firewalld generates.

• Pods with the HostPort parameter settings are automatically available. This also includes the router-default pod, which uses ports 80 and 443.

  For HostPort pods, the CRI-O config sets up iptables DNAT (Destination Network Address Translation) to the pod’s IP address and port.

• To avoid breaking traffic flows with a firewall reload or restart, execute firewall commands before starting Red Hat Enterprise Linux (RHEL). The CNI driver in MicroShift makes use of iptable rules for some traffic flows, such as those using the NodePort service. The iptable rules are generated and inserted by the CNI driver, but are deleted when the firewall reloads or restarts. The absence of the iptable rules breaks traffic flows. If firewall commands have to be executed after MicroShift is running, manually restart ovnkube-master pod in the openshift-ovn-kubernetes namespace to reset the rules controlled by the CNI driver.