2.11. Auditing exposed network ports

Procedure

1. Optional: You can check that the hostNetwork:true parameter is set in your ovnkube-node pod by using the following example command:

   $ sudo oc get pod -n openshift-ovn-kubernetes <ovnkube-node-pod-name> -o json | jq -r '.spec.hostNetwork' true

2. Enable debug in the firewalld log by running the following command:

   $ sudo vi /etc/sysconfig/firewalld
   FIREWALLD_ARGS=--debug=10

3. Restart the firewalld service:

   $ sudo systemctl restart firewalld.service

4. To verify that the debug option was added properly, run the following command:

   $ sudo systemd-cgls -u firewalld.service

   The firewalld debug log is stored in the /var/log/firewalld path.

   Example logs for when the port open rule is added

   2023-06-28 10:46:37 DEBUG1: config.getZoneByName('public')
   2023-06-28 10:46:37 DEBUG1: config.zone.7.addPort('8080', 'tcp')
   2023-06-28 10:46:37 DEBUG1: config.zone.7.getSettings()
   2023-06-28 10:46:37 DEBUG1: config.zone.7.update('...')
   2023-06-28 10:46:37 DEBUG1: config.zone.7.Updated('public')

   Example logs for when the port open rule is removed

   2023-06-28 10:47:57 DEBUG1: config.getZoneByName('public')
   2023-06-28 10:47:57 DEBUG2: config.zone.7.Introspect()
   2023-06-28 10:47:57 DEBUG1: config.zone.7.removePort('8080', 'tcp')
   2023-06-28 10:47:57 DEBUG1: config.zone.7.getSettings()
   2023-06-28 10:47:57 DEBUG1: config.zone.7.update('...')
   2023-06-28 10:47:57 DEBUG1: config.zone.7.Updated('public')

Procedure

1. To access the name of your ovnkube-master pods, run the following command:

   $ oc get pods -n openshift-ovn-kubernetes | awk '/ovnkube-master/{print $1}'

   Example ovnkube-master pod name

   ovnkube-master-n2shv

2. You can access the NodePort and LoadBalancer services logs using your ovnkube-master pod and running the following example command:

   $ oc logs -n openshift-ovn-kubernetes <ovnkube-master-pod-name> ovnkube-master | grep -E "OVN-KUBE-NODEPORT|OVN-KUBE-EXTERNALIP"

   NodePort service:

   Example logs in the ovnkube-master container of the ovnkube-master pod when a host port is open

   $ I0625 09:07:00.992980 2118395 iptables.go:27] Adding rule in table: nat, chain: OVN-KUBE-NODEPORT with args: "-p TCP -m addrtype --dst-type LOCAL --dport 32718 -j DNAT --to-destination 10.96.178.142:8081" for protocol: 0

   Example logs in the ovnkube-master container of the ovnkube-master pod when a host port is closed

   $ Deleting rule in table: nat, chain: OVN-KUBE-NODEPORT with args: "-p TCP -m addrtype --dst-type LOCAL --dport 32718 -j DNAT --to-destination 10.96.178.142:8081" for protocol: 0

   LoadBalancer service:

   Example logs in the ovnkube-master container of the ovnkube-master pod when a host port is open

   $ I0625 09:34:10.406067  128902 iptables.go:27] Adding rule in table: nat, chain: OVN-KUBE-EXTERNALIP with args: "-p TCP -d 172.16.47.129 --dport 8081 -j DNAT --to-destination 10.43.114.94:8081" for protocol: 0

   Example logs in the ovnkube-master container of the ovnkube-master pod when a host port is closed

   $ I0625 09:37:00.976953  128902 iptables.go:63] Deleting rule in table: nat, chain: OVN-KUBE-EXTERNALIP with args: "-p TCP -d 172.16.47.129 --dport 8081 -j DNAT --to-destination 10.43.114.94:8081" for protocol: 0