|
| 1 | +:_mod-docs-content-type: PROCEDURE |
| 2 | + |
| 3 | +[id="opening-required-ports"] |
| 4 | += Opening required ports |
| 5 | + |
| 6 | +For the components of {Project} architecture to communicate, ensure that the required network ports are open and free on the base operating system. |
| 7 | +You must also ensure that the required network ports are open on any network-based firewalls. |
| 8 | + |
| 9 | +[NOTE] |
| 10 | +==== |
| 11 | +Some cloud solutions must be specifically configured to allow communications between machines because they isolate machines similarly to network-based firewalls. |
| 12 | +If you use an application-based firewall, ensure that the application-based firewall permits all applications that are listed in the tables and known to your firewall. |
| 13 | +If possible, disable the application checking and allow open port communication based on the protocol. |
| 14 | +==== |
| 15 | + |
| 16 | +ifndef::satellite,orcharhino[] |
| 17 | +If you do not use `firewall-cmd` to configure the Linux firewall, implement using the command of your choice. |
| 18 | +endif::[] |
| 19 | + |
| 20 | +.Procedure |
| 21 | +. Optional: If you need to prevent the DHCP {SmartProxy} from pinging hosts to check for available IP addresses, disable DHCP IP address pinging: |
| 22 | ++ |
| 23 | +[options="nowrap", subs="+quotes,attributes"] |
| 24 | +---- |
| 25 | +# {foreman-installer} --foreman-proxy-dhcp-ping-free-ip false |
| 26 | +---- |
| 27 | ++ |
| 28 | +By default, a DHCP {SmartProxy} performs ICMP ping and TCP echo connection attempts to hosts in subnets with DHCP IPAM set to find out if an IP address considered for use is free. |
| 29 | +ifdef::katello,satellite,orcharhino[] |
| 30 | +ifeval::["{context}" == "{project-context}"] |
| 31 | +. Open the ports for clients on {ProjectServer}: |
| 32 | +endif::[] |
| 33 | +ifeval::["{context}" == "{smart-proxy-context}"] |
| 34 | +. Open the ports for clients on {SmartProxyServer}: |
| 35 | +endif::[] |
| 36 | ++ |
| 37 | +[options="nowrap"] |
| 38 | +---- |
| 39 | +# firewall-cmd \ |
| 40 | +--add-port="8000/tcp" \ |
| 41 | +--add-port="9090/tcp" |
| 42 | +---- |
| 43 | +endif::[] |
| 44 | +ifeval::["{context}" == "{project-context}"] |
| 45 | +. Allow access to services on {ProjectServer}: |
| 46 | +endif::[] |
| 47 | +ifeval::["{context}" == "{smart-proxy-context}"] |
| 48 | +. Allow access to services on {SmartProxyServer}: |
| 49 | +endif::[] |
| 50 | ++ |
| 51 | +[options="nowrap"] |
| 52 | +---- |
| 53 | +# firewall-cmd \ |
| 54 | +--add-service=dns \ |
| 55 | +--add-service=dhcp \ |
| 56 | +--add-service=tftp \ |
| 57 | +--add-service=http \ |
| 58 | +--add-service=https \ |
| 59 | +ifndef::katello,satellite,orcharhino[] |
| 60 | +--add-service=foreman-proxy \ |
| 61 | +endif::[] |
| 62 | +--add-service=puppetmaster |
| 63 | +---- |
| 64 | +. Make the changes persistent: |
| 65 | ++ |
| 66 | +[options="nowrap", subs="+quotes,verbatim,attributes"] |
| 67 | +---- |
| 68 | +# firewall-cmd --runtime-to-permanent |
| 69 | +---- |
| 70 | + |
| 71 | +.Verification |
| 72 | +* Enter the following command: |
| 73 | ++ |
| 74 | +[options="nowrap"] |
| 75 | +---- |
| 76 | +# firewall-cmd --list-all |
| 77 | +---- |
| 78 | + |
| 79 | +.Additional resources |
| 80 | +* {PlanningDocURL}networking-in-a-{project-context}-deployment[Networking in a {Project} deployment] |
| 81 | +ifndef::foreman-deb[] |
| 82 | +* https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/using-and-configuring-firewalld_firewall-packet-filters/9/html/configuring_firewalls_and_packet_filters/using-and-configuring-firewalld_firewall-packet-filters[Using and configuring firewalld in _{RHEL}{nbsp}9 Configuring firewalls and packet filters_] |
| 83 | +endif::[] |
0 commit comments