Firewalls and default ports¶
On some deployments, such as ones where restrictive firewalls are in place, you might need to manually configure a firewall to permit OpenStack service traffic.
To manually configure a firewall, you must permit traffic through the ports that each OpenStack service uses. This table lists the default ports that each OpenStack service uses:
OpenStack service |
Default ports |
---|---|
Application Catalog ( |
8082 |
Backup Service ( |
9090 |
Big Data Processing Framework ( |
8386 |
Block Storage ( |
8776 |
Clustering ( |
8777 |
Compute ( |
8774 |
Compute ports for access to virtual machine consoles |
5900-5999 |
Compute VNC proxy for browsers (openstack-nova-novncproxy) |
6080 |
Compute VNC proxy for traditional VNC clients (openstack-nova-xvpvncproxy) |
6081 |
Container Infrastructure Management ( |
9511 |
Container Service ( |
9517 |
Data processing service ( |
8386 |
Database service ( |
8779 |
DNS service ( |
9001 |
High Availability Service ( |
15868 |
Identity service ( |
5000 |
Image service ( |
9292 |
Key Manager service ( |
9311 |
Loadbalancer service ( |
9876 |
Networking ( |
9696 |
NFV Orchestration service ( |
9890 |
Object Storage ( |
6000, 6001, 6002 |
Orchestration ( |
8004 |
Orchestration AWS CloudFormation-compatible API ( |
8000 |
Orchestration AWS CloudWatch-compatible API ( |
8778 |
Placement API ( |
8003 |
Proxy port for HTML5 console used by Compute service |
6082 |
Rating service ( |
8889 |
Registration service ( |
5050 |
Resource Reservation service ( |
1234 |
Root Cause Analysis service ( |
8999 |
Shared File Systems service ( |
8786 |
Telemetry alarming service ( |
8042 |
Telemetry event service ( |
8977 |
Workflow service ( |
8989 |
To function properly, some OpenStack components depend on other, non-OpenStack services. For example, the OpenStack dashboard uses HTTP for non-secure communication. In this case, you must configure the firewall to allow traffic to and from HTTP.
This table lists the ports that other OpenStack components use:
Сервис |
Default port |
Used by |
---|---|---|
HTTP |
80 |
OpenStack dashboard ( |
HTTP alternate |
8080 |
OpenStack Object Storage ( |
HTTPS |
443 |
Any OpenStack service that is enabled for SSL, especially secure-access dashboard. |
rsync |
873 |
OpenStack Object Storage. Required. |
iSCSI target |
3260 |
OpenStack Block Storage. Required when using LVM with iSCSI target (tgt, LIO, iSER) |
NVMe-oF target |
4420 |
OpenStack Block Storage. Required when using LVM with NVMe-oF target (nvmet). |
MySQL database service |
3306 |
Most OpenStack components. |
Message Broker (AMQP traffic) |
5672 |
OpenStack Block Storage, Networking, Orchestration, and Compute. |
On some deployments, the default port used by a service may fall within the defined local port range of a host. To check a host’s local port range:
$ sysctl net.ipv4.ip_local_port_range
If a service’s default port falls within this range, run the following program to check if the port has already been assigned to another application:
$ lsof -i :PORT
Configure the service to use a different port if the default port is already being used by another application.