On some deployments, such as ones where restrictive firewalls are in place, you might need to manually configure a firewall to permit OpenStack service traffic.
To manually configure a firewall, you must permit traffic through the ports that each OpenStack service uses. This table lists the default ports that each OpenStack service uses:
| OpenStack service | Default ports | Port type |
|---|---|---|
Block Storage (cinder) |
8776 | publicurl and adminurl |
Compute (nova) endpoints |
8774 | publicurl and adminurl |
Compute API (nova-api) |
8773, 8775 | |
| Compute ports for access to virtual machine consoles | 5900-5999 | |
Compute VNC proxy for browsers (
openstack-nova-novncproxy) |
6080 | |
Compute VNC proxy for traditional VNC clients
(openstack-nova-xvpvncproxy) |
6081 | |
| Proxy port for HTML5 console used by Compute service | 6082 | |
Identity service (keystone)
administrative endpoint |
35357 | adminurl |
| Identity service public endpoint | 5000 | publicurl |
Image Service (glance) API |
9292 | publicurl and adminurl |
| Image Service registry | 9191 | |
Networking (neutron) |
9696 | publicurl and adminurl |
Object Storage (swift) |
6000, 6001, 6002 | |
Orchestration (heat)
endpoint |
8004 | publicurl and adminurl |
Orchestration AWS CloudFormation-compatible API
(openstack-heat-api-cfn) |
8000 | |
Orchestration AWS CloudWatch-compatible API
(openstack-heat-api-cloudwatch) |
8003 | |
Telemetry (ceilometer) |
8777 | publicurl and adminurl |
To function properly, some OpenStack components depend on other, non-OpenStack services. For example, the OpenStack dashboard uses HTTP for non-secure communication. In this case, you must configure the firewall to allow traffic to and from HTTP.
This table lists the ports that other OpenStack components use:
| Service | Default port | Used by |
|---|---|---|
| HTTP | 80 | OpenStack dashboard (Horizon)
when it is not configured to use secure
access. |
| HTTP alternate | 8080 | OpenStack Object Storage
(swift) service. |
| HTTPS | 443 | Any OpenStack service that is enabled for SSL, especially secure-access dashboard. |
| rsync | 873 | OpenStack Object Storage. Required. |
| iSCSI target | 3260 | OpenStack Block Storage. Required. |
| MySQL database service | 3306 | Most OpenStack components. |
| Message Broker (AMQP traffic) | 5672 | OpenStack Block Storage, Networking, Orchestration, and Compute. |
On some deployments, the default port used by a service may fall within the defined local port range of a host. To check a host's local port range:
$ sysctl -a | grep ip_local_port_range
If a service's default port falls within this range, run the following program to check if the port has already been assigned to another application:
$ lsof -i :PORTConfigure the service to use a different port if the default port is already being used by another application.
