Skip to main content
Version: NG-3.1

vuSmartMaps – Default Firewalld Whitelisting Configuration

Purpose​

vuSmartMaps installation generally mandates any firewalls on the cluster nodes to be disabled. This is to avoid conflicting rules that block K8S cluster communications managed by iptables. However in some production deployments, firewalld is mandated by organization’s InfoSec compliance. Use the whitelisting configurations mentioned here to ensure vuSmartMaps cluster and external communications are not impacted.

Default Whitelisting Configuration​

Run the following on every node, as root, before or immediately after enabling firewalld:

Trusted Zone — Kubernetes Internal Interfaces​

Move Kubernetes-internal interfaces to the trusted zone (unrestricted) and trust the pod/service CIDRs:

# Trusted zone: K8s internal interfaces -- ACCEPT all, no restrictions
firewall-cmd --permanent --zone=trusted --add-interface=cni0
firewall-cmd --permanent --zone=trusted --add-interface=flannel.1
firewall-cmd --permanent --zone=trusted --add-source=10.32.0.0/20   # pod CIDR
firewall-cmd --permanent --zone=trusted --add-source=10.96.0.0/22   # service CIDR

Public Zone — External Interface​

Bind the public zone only to the real external interface, and allow baseline admin access:

# Public zone: external interface only
# eth0 = real external interface | verify with 'ip a' before applying
firewall-cmd --permanent --zone=public --add-interface=eth0
firewall-cmd --permanent --zone=public --add-service=ssh
firewall-cmd --permanent --zone=public --add-service=cockpit
firewall-cmd --permanent --zone=public --add-service=dhcpv6-client

Public Zone — Kubernetes Control Plane Ports​

firewall-cmd --permanent --zone=public --add-port=6443/tcp        # Kubernetes API server
firewall-cmd --permanent --zone=public --add-port=2379-2380/tcp   # etcd
firewall-cmd --permanent --zone=public --add-port=10250/tcp       # kubelet
firewall-cmd --permanent --zone=public --add-port=10257/tcp       # controller-manager
firewall-cmd --permanent --zone=public --add-port=10259/tcp       # scheduler
firewall-cmd --permanent --zone=public --add-port=8472/udp        # Flannel VXLAN
firewall-cmd --permanent --zone=public --add-port=30000-32767/tcp # Kubernetes NodePort range

Public Zone — vuSmartMaps Application Ports​

firewall-cmd --permanent --zone=public --add-port=9092/tcp    # Kafka
firewall-cmd --permanent --zone=public --add-port=9094/tcp    # Kafka TLS
firewall-cmd --permanent --zone=public --add-port=9000/tcp    # MinIO S3 API
firewall-cmd --permanent --zone=public --add-port=9001/tcp    # MinIO Console
firewall-cmd --permanent --zone=public --add-port=8123/tcp    # ClickHouse HTTP
firewall-cmd --permanent --zone=public --add-port=9009/tcp    # ClickHouse replication
firewall-cmd --permanent --zone=public --add-port=4317/tcp    # OpenTelemetry gRPC
firewall-cmd --permanent --zone=public --add-port=4318/tcp    # OpenTelemetry HTTP
firewall-cmd --permanent --zone=public --add-port=8080/tcp    # HTTP UI / Keycloak
firewall-cmd --permanent --zone=public --add-port=8443/tcp    # HTTPS UI
firewall-cmd --permanent --zone=public --add-port=9444/tcp    # vuSmartMaps API
firewall-cmd --permanent --zone=public --add-port=514/udp     # Syslog
firewall-cmd --permanent --zone=public --add-port=5514/udp    # Syslog (alt)

Masquerade, Forwarding and Anti-Spoofing​

firewall-cmd --permanent --zone=public --add-forward
firewall-cmd --permanent --zone=public --add-masquerade
 
# Anti-spoofing
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="127.0.0.1" destination not address="127.0.0.1" drop'
firewall-cmd --permanent --add-rich-rule='rule family="ipv6" source address="::1" destination not address="::1" drop'

Apply and Verify​

firewall-cmd --reload
firewall-cmd --zone=public --list-all
firewall-cmd --zone=trusted --list-all

Instructions for CSG / Linux Administrators​

  • Treat Section 2 above as the DEFAULT whitelisting configuration for every vuSmartMaps node that runs firewalld.

  • Verify the actual external NIC name (ip a / ip route) before running Section 2.2 — do not assume eth0 if the environment uses a different NIC name.

  • Apply the same configuration identically on all nodes in the cluster.

  • After applying, restart kube-proxy if the cluster is already running: kubectl rollout restart daemonset kube-proxy -n kube-system.

  • Do not place cni0 / flannel.1 in the public zone — this silently blocks pod-to-API traffic and breaks CoreDNS.

Handling Port Changes in the Target Environment​

note

If any vuSmartMaps component is reconfigured to use a port different from the defaults listed in Section 2, that port must be explicitly whitelisted with firewall-cmd and the firewall must be reloaded. Do not assume a non-default port will work without this step — firewalld default-denies anything not explicitly listed in the public zone.

Example — Adding a Custom TCP Port​

Example: a component originally on 8443/tcp is moved to 8543/tcp.

firewall-cmd --permanent --zone=public --add-port=8543/tcp
firewall-cmd --reload
firewall-cmd --zone=public --list-ports    # confirm 8543/tcp is listed

Example — Adding a Custom UDP Port​

Example: syslog is reconfigured from 5514/udp to 6514/udp.

firewall-cmd --permanent --zone=public --add-port=6514/udp
firewall-cmd --reload
firewall-cmd --zone=public --list-ports    # confirm 6514/udp is listed

Always use --permanent when adding the port so the rule survives a reboot, and always follow it with firewall-cmd --reload to activate the change.