Skip to main content
Version: NG-3.2

vuSmartMaps – Default Firewalld Whitelisting Configuration

Purpose​

This note captures the firewalld whitelisting configuration for vuSmartMaps clusters. Use the configuration below as the DEFAULT whitelisting baseline whenever firewalld is enabled on a vuSmartMaps node — whether during fresh installation or while hardening an existing cluster.

This configuration was validated after an incident where an earlier version of configure-firewalld.sh placed Kubernetes-internal interfaces in the wrong zone, left masquerade disabled, and referenced a non-existent network interface — causing CoreDNS and all dependent pods to enter CrashLoopBackOff. The steps below are the corrected, tested fix.

Default Whitelisting Configuration​

Run the following on every node, as root, before or immediately after enabling firewalld:

Trusted Zone — Kubernetes Internal Interfaces​

Move Kubernetes-internal interfaces to the trusted zone (unrestricted) and trust the pod/service CIDRs:

# Trusted zone: K8s internal interfaces -- ACCEPT all, no restrictions
firewall-cmd --permanent --zone=trusted --add-interface=cni0
firewall-cmd --permanent --zone=trusted --add-interface=flannel.1
firewall-cmd --permanent --zone=trusted --add-source=10.32.0.0/20   # pod CIDR
firewall-cmd --permanent --zone=trusted --add-source=10.96.0.0/22   # service CIDR

Public Zone — External Interface​

Bind the public zone only to the real external interface, and allow baseline admin access:

# Public zone: external interface only
# eth0 = real external interface | verify with 'ip a' before applying
firewall-cmd --permanent --zone=public --add-interface=eth0
firewall-cmd --permanent --zone=public --add-service=ssh
firewall-cmd --permanent --zone=public --add-service=cockpit
firewall-cmd --permanent --zone=public --add-service=dhcpv6-client

Public Zone — Kubernetes Control Plane Ports​

firewall-cmd --permanent --zone=public --add-port=6443/tcp        # Kubernetes API server
firewall-cmd --permanent --zone=public --add-port=2379-2380/tcp   # etcd
firewall-cmd --permanent --zone=public --add-port=10250/tcp       # kubelet
firewall-cmd --permanent --zone=public --add-port=10257/tcp       # controller-manager
firewall-cmd --permanent --zone=public --add-port=10259/tcp       # scheduler
firewall-cmd --permanent --zone=public --add-port=8472/udp        # Flannel VXLAN
firewall-cmd --permanent --zone=public --add-port=30000-32767/tcp # Kubernetes NodePort range

Public Zone — vuSmartMaps Application Ports​

firewall-cmd --permanent --zone=public --add-port=9092/tcp    # Kafka
firewall-cmd --permanent --zone=public --add-port=9094/tcp    # Kafka TLS
firewall-cmd --permanent --zone=public --add-port=9000/tcp    # MinIO S3 API
firewall-cmd --permanent --zone=public --add-port=9001/tcp    # MinIO Console
firewall-cmd --permanent --zone=public --add-port=8123/tcp    # ClickHouse HTTP
firewall-cmd --permanent --zone=public --add-port=9009/tcp    # ClickHouse replication
firewall-cmd --permanent --zone=public --add-port=4317/tcp    # OpenTelemetry gRPC
firewall-cmd --permanent --zone=public --add-port=4318/tcp    # OpenTelemetry HTTP
firewall-cmd --permanent --zone=public --add-port=8080/tcp    # HTTP UI / Keycloak
firewall-cmd --permanent --zone=public --add-port=8443/tcp    # HTTPS UI
firewall-cmd --permanent --zone=public --add-port=9444/tcp    # vuSmartMaps API
firewall-cmd --permanent --zone=public --add-port=514/udp     # Syslog
firewall-cmd --permanent --zone=public --add-port=5514/udp    # Syslog (alt)

Masquerade, Forwarding and Anti-Spoofing​

firewall-cmd --permanent --zone=public --add-forward
firewall-cmd --permanent --zone=public --add-masquerade
 
# Anti-spoofing
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="127.0.0.1" destination not address="127.0.0.1" drop'
firewall-cmd --permanent --add-rich-rule='rule family="ipv6" source address="::1" destination not address="::1" drop'

Apply and Verify​

firewall-cmd --reload
firewall-cmd --zone=public --list-all
firewall-cmd --zone=trusted --list-all

Instructions for CSG / Linux Administrators​

  • Treat Section 2 above as the DEFAULT whitelisting configuration for every vuSmartMaps node that runs firewalld.

  • Verify the actual external NIC name (ip a / ip route) before running Section 2.2 — do not assume eth0 if the environment uses a different NIC name.

  • Apply the same configuration identically on all nodes in the cluster.

  • After applying, restart kube-proxy if the cluster is already running: kubectl rollout restart daemonset kube-proxy -n kube-system.

  • Do not place cni0 / flannel.1 in the public zone — this silently blocks pod-to-API traffic and breaks CoreDNS.

Handling Port Changes in the Target Environment​

note

If any vuSmartMaps component is reconfigured to use a port different from the defaults listed in Section 2, that port must be explicitly whitelisted with firewall-cmd and the firewall must be reloaded. Do not assume a non-default port will work without this step — firewalld default-denies anything not explicitly listed in the public zone.

Example — Adding a Custom TCP Port​

Example: a component originally on 8443/tcp is moved to 8543/tcp.

firewall-cmd --permanent --zone=public --add-port=8543/tcp
firewall-cmd --reload
firewall-cmd --zone=public --list-ports    # confirm 8543/tcp is listed

Example — Adding a Custom UDP Port​

Example: syslog is reconfigured from 5514/udp to 6514/udp.

firewall-cmd --permanent --zone=public --add-port=6514/udp
firewall-cmd --reload
firewall-cmd --zone=public --list-ports    # confirm 6514/udp is listed

Always use --permanent when adding the port so the rule survives a reboot, and always follow it with firewall-cmd --reload to activate the change.