Chapter 7. Using a firewall Firewalls are not required in MicroShift, but using a firewall can prevent undesired access to the MicroShift API. 7.1. About network traffic through the firewall Firewalld is a networking service that runs in the background and responds to connection requests, creating a dynamic customizable host-based firewall. If you are using Red Hat Enterprise Linux for Edge (RHEL for Edge) with MicroShift, firewalld should already be installed and you just need to configure it. Details are provided in procedures that follow. Overall, you must explicitly allow the following OVN-Kubernetes traffic when the firewalld service is running: CNI pod to CNI pod CNI pod to Host-Network pod Host-Network pod to Host-Network pod CNI pod The Kubernetes pod that uses the CNI network Host-Network pod The Kubernetes pod that uses host network You can configure the firewalld service by using the following procedures. In most cases, firewalld is part of RHEL for Edge installations. If you do not have firewalld, you can install it with the simple procedure in this section. Important MicroShift pods must have access to the internal CoreDNS component and API servers. Additional resources Required firewall settings Allowing network traffic through the firewall 7.2. Installing the firewalld service If you are using RHEL for Edge, firewalld should be installed. To use the service, you can simply configure it. The following procedure can be used if you do not have firewalld, but want to use it. Install and run the firewalld service for MicroShift by using the following steps. Procedure Optional: Check for firewalld on your system by running the following command: USD rpm -q firewalld If the firewalld service is not installed, run the following command: USD sudo dnf install -y firewalld To start the firewall, run the following command: USD sudo systemctl enable firewalld --now 7.3. Required firewall settings An IP address range for the cluster network must be enabled during firewall configuration. You can use the default values or customize the IP address range. If you choose to customize the cluster network IP address range from the default 10.42.0.0/16 setting, you must also use the same custom range in the firewall configuration. Table 7.1. Firewall IP address settings IP Range Firewall rule required Description 10.42.0.0/16 No Host network pod access to other pods 169.254.169.1 Yes Host network pod access to Red Hat build of MicroShift API server The following are examples of commands for settings that are mandatory for firewall configuration: Example commands Configure host network pod access to other pods: USD sudo firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 Configure host network pod access to services backed by Host endpoints, such as the Red Hat build of MicroShift API: USD sudo firewall-cmd --permanent --zone=trusted --add-source=169.254.169.1 7.4. Using optional port settings The MicroShift firewall service allows optional port settings. Procedure To add customized ports to your firewall configuration, use the following command syntax: USD sudo firewall-cmd --permanent --zone=public --add-port=<port number>/<port protocol> Table 7.2. Optional ports Port(s) Protocol(s) Description 80 TCP HTTP port used to serve applications through the OpenShift Container Platform router. 443 TCP HTTPS port used to serve applications through the OpenShift Container Platform router. 5353 UDP mDNS service to respond for OpenShift Container Platform route mDNS hosts. 30000-32767 TCP Port range reserved for NodePort services; can be used to expose applications on the LAN. 30000-32767 UDP Port range reserved for NodePort services; can be used to expose applications on the LAN. 6443 TCP HTTPS API port for the Red Hat build of MicroShift API. The following are examples of commands used when requiring external access through the firewall to services running on MicroShift, such as port 6443 for the API server, for example, ports 80 and 443 for applications exposed through the router. Example command Configuring a port for the MicroShift API server: USD sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp To close unnecessary ports in your MicroShift instance, follow the procedure in "Closing unused or unnecessary ports to enhance network security". Additional resources Closing unused or unnecessary ports to enhance network security 7.5. Adding services to open ports On a MicroShift instance, you can open services on ports by using the firewall-cmd command. Procedure Optional: You can view all predefined services in firewalld by running the following command USD sudo firewall-cmd --get-services To open a service that you want on a default port, run the following example command: USD sudo firewall-cmd --add-service=mdns 7.6. Allowing network traffic through the firewall You can allow network traffic through the firewall by configuring the IP address range and inserting the DNS server to allow internal traffic from pods through the network gateway. Procedure Use one of the following commands to set the IP address range: Configure the IP address range with default values by running the following command: USD sudo firewall-offline-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 Configure the IP address range with custom values by running the following command: USD sudo firewall-offline-cmd --permanent --zone=trusted --add-source=<custom IP range> To allow internal traffic from pods through the network gateway, run the following command: USD sudo firewall-offline-cmd --permanent --zone=trusted --add-source=169.254.169.1 If you are using a load balancer, allow the IPv6 traffic through the firewall by running the following command: USD sudo firewall-cmd --permanent --zone=trusted --add-source=fd01::/48 7.6.1. Applying firewall settings To apply firewall settings, use the following one-step procedure: Procedure After you have finished configuring network access through the firewall, run the following command to restart the firewall and apply the settings: USD sudo firewall-cmd --reload 7.7. Verifying firewall settings After you have restarted the firewall, you can verify your settings by listing them. Procedure To verify rules added in the default public zone, such as ports-related rules, run the following command: USD sudo firewall-cmd --list-all To verify rules added in the trusted zone, such as IP-range related rules, run the following command: USD sudo firewall-cmd --zone=trusted --list-all 7.8. Overview of firewall ports when a service is exposed Firewalld is often active when you run services on MicroShift. This can disrupt certain services on MicroShift because traffic to the ports might be blocked by the firewall. You must ensure that the necessary firewall ports are open if you want certain services to be accessible from outside the host. There are several options for opening your ports: Services of the NodePort and LoadBalancer type are automatically available with OVN-Kubernetes. In these cases, OVN-Kubernetes adds iptables rules so the traffic to the node IP address is delivered to the relevant ports. This is done using the PREROUTING rule chain and is then forwarded to the OVN-K to bypass the firewalld rules for local host ports and services. Iptables and firewalld are backed by nftables in Red Hat Enterprise Linux (RHEL) 9. The nftables rules, which the iptables generates, always have priority over the rules that the firewalld generates. Pods with the HostPort parameter settings are automatically available. This also includes the router-default pod, which uses ports 80 and 443. For HostPort pods, the CRI-O config sets up iptables DNAT (Destination Network Address Translation) to the pod's IP address and port. These methods function for clients whether they are on the same host or on a remote host. The iptables rules, which are added by OVN-Kubernetes and CRI-O, attach to the PREROUTING and OUTPUT chains. The local traffic goes through the OUTPUT chain with the interface set to the lo type. The DNAT runs before it hits filler rules in the INPUT chain. Because the MicroShift API server does not run in CRI-O, it is subject to the firewall configurations. You can open port 6443 in the firewall to access the API server in your MicroShift cluster. 7.9. Additional resources RHEL: Using and configuring firewalld RHEL: Viewing the current status of firewalld 7.10. Known firewall issue To avoid breaking traffic flows with a firewall reload or restart, execute firewall commands before starting Red Hat Enterprise Linux (RHEL). The CNI driver in MicroShift makes use of iptable rules for some traffic flows, such as those using the NodePort service. The iptable rules are generated and inserted by the CNI driver, but are deleted when the firewall reloads or restarts. The absence of the iptable rules breaks traffic flows. If firewall commands have to be executed after MicroShift is running, manually restart ovnkube-master pod in the openshift-ovn-kubernetes namespace to reset the rules controlled by the CNI driver.

Commands:
rpm -q firewalld
sudo dnf install -y firewalld
sudo systemctl enable firewalld --now
sudo firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16
sudo firewall-cmd --permanent --zone=trusted --add-source=169.254.169.1
sudo firewall-cmd --permanent --zone=public --add-port=<port number>/<port protocol>
sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp
sudo firewall-cmd --get-services
sudo firewall-cmd --add-service=mdns
sudo firewall-offline-cmd --permanent --zone=trusted --add-source=10.42.0.0/16
sudo firewall-offline-cmd --permanent --zone=trusted --add-source=<custom IP range>
sudo firewall-offline-cmd --permanent --zone=trusted --add-source=169.254.169.1
sudo firewall-cmd --permanent --zone=trusted --add-source=fd01::/48
sudo firewall-cmd --reload
sudo firewall-cmd --list-all
sudo firewall-cmd --zone=trusted --list-all