Red Hat OpenStack Platform 13

Firewall Rules for Red Hat OpenStack

Platform

List of required ports and protocols.

Last Updated: 2018-06-27

Red Hat OpenStack Platform 13 Firewall Rules for Red Hat OpenStack
Platform
List of required ports and protocols.

OpenStack Team
[email protected]
Legal Notice
Copyright © 2018 Red Hat, Inc.

The text of and illustrations in this document are licensed by Red Hat under a Creative Commons
Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is
available at
http://creativecommons.org/licenses/by-sa/3.0/
. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must
provide the URL for the original version.

Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert,
Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.

Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, OpenShift, Fedora, the Infinity
logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other
countries.

Linux ® is the registered trademark of Linus Torvalds in the United States and other countries.

Java ® is a registered trademark of Oracle and/or its affiliates.

XFS ® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States
and/or other countries.

MySQL ® is a registered trademark of MySQL AB in the United States, the European Union and
other countries.

Node.js ® is an official trademark of Joyent. Red Hat Software Collections is not formally related to
or endorsed by the official Joyent Node.js open source or commercial project.

The OpenStack ® Word Mark and OpenStack logo are either registered trademarks/service marks
or trademarks/service marks of the OpenStack Foundation, in the United States and other countries
and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or
sponsored by the OpenStack Foundation, or the OpenStack community.

All other trademarks are the property of their respective owners.

Abstract
This article describes the firewall rules created by the Red Hat OpenStack Platform director.
 Table of Contents

Table of Contents
.CHAPTER
. . . . . . . . .1.. .FIREWALL
. . . . . . . . . .RULES
. . . . . . FOR
. . . . .RED
. . . .HAT
. . . .OPENSTACK
. . . . . . . . . . . .PLATFORM
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3. . . . . . . . . .
1.1. NOVA API 3
1.2. HAPROXY 3
1.3. GLANCE REGISTRY API 3
1.4. CEILOMETER API 3
1.5. KEYSTONE 4
1.6. IRONIC CONDUCTOR 4
1.7. NOVA LIBVIRT 4
1.8. RABBITMQ 4
1.9. GLANCE API 4
1.10. KEEPALIVED 5
1.11. REDIS 5
1.12. MYSQL GALERA 5
1.13. MONGODB 5
1.14. NTP 6
1.15. SWIFT STORAGE 6
1.16. CEPH OSD 6
1.17. NEUTRON L3 6
1.18. HEAT CLOUDFORMATION API SERVICE 6
1.19. GNOCCHI API 7
1.20. GNOCCHI STATSD 7
1.21. NEUTRON DHCP 7
1.22. CEILOMETER SNMP 7
1.23. HEAT API 7
1.24. NEUTRON OVS AGENT 8
1.25. SWIFT PROXY 8
1.26. HEAT AWS CLOUDWATCH-COMPATIBLE API 8
1.27. MEMCACHED SERVICE 8
1.28. CEPH MONITOR SERVICE 8
1.29. CEPH RADOSGW SERVICE 9
1.30. CINDER API 9
1.31. CINDER VOLUME ISCSI INITIATOR 9
1.32. IRONIC API 9
1.33. PACEMAKER 9
1.34. SAHARA API 10
1.35. NEUTRON API 10
1.36. HORIZON 10
1.37. AODH API 10
1.38. MANILA API 10

1
Red Hat OpenStack Platform 13 Firewall Rules for Red Hat OpenStack Platform

2
 CHAPTER 1. FIREWALL RULES FOR RED HAT OPENSTACK PLATFORM

CHAPTER 1. FIREWALL RULES FOR RED HAT OPENSTACK

PLATFORM
This article describes the firewall configuration created by the director on Red Hat OpenStack Platform.
These ports are required for services running on the overcloud.

1.1. NOVA API

Service Protocol Ports Notes

nova TCP 6080 Nova novnc Proxy

nova TCP 13080 Nova novnc Proxy (SSL)

nova TCP 8773 Nova EC2 API

nova TCP 3773 Nova EC2 API (SSL)

nova TCP 8774 Nova API

nova TCP 13774 Nova API (SSL)

nova TCP 8775 Nova Metadata

1.2. HAPROXY

Service Protocol Ports Notes

haproxy_stats TCP 1993

1.3. GLANCE REGISTRY API

Service Protocol Ports Notes

glance TCP 9191 Glance Registry API

1.4. CEILOMETER API

Service Protocol Ports Notes

ceilometer TCP 8777 Ceilometer API

ceilometer TCP 13777 Ceilometer API (SSL)

3
Red Hat OpenStack Platform 13 Firewall Rules for Red Hat OpenStack Platform

1.5. KEYSTONE

Service Protocol Ports Notes

keystone TCP 5000 Keystone Public API

keystone TCP 13000 Keystone Public API

(SSL)

keystone TCP 35357 Keystone Admin API

keystone TCP 13357 Keystone Admin API

(SSL)

1.6. IRONIC CONDUCTOR

Service Protocol Ports Notes

TFTP UDP 69

HTTP TCP 8088

1.7. NOVA LIBVIRT

Service Protocol Ports Notes

nova_libvirt TCP 16514

1.8. RABBITMQ

Service Protocol Ports Notes

rabbitmq TCP 4369 Rabbitmq

rabbitmq TCP 5672 Rabbitmq

rabbitmq TCP 25672 Rabbitmq

1.9. GLANCE API

Service Protocol Ports Notes

glance TCP 9292 Glance API

4
 CHAPTER 1. FIREWALL RULES FOR RED HAT OPENSTACK PLATFORM

Service Protocol Ports Notes

glance TCP 13292 Glance API (SSL)

1.10. KEEPALIVED

Service Protocol Ports Notes

VRRP VRRP VRRP

1.11. REDIS

Service Protocol Ports Notes

redis TCP 6379 Internal service

coordination

redis TCP 26379

1.12. MYSQL GALERA

Service Protocol Ports Notes

mysql_galera TCP 873 MySQL

mysql_galera TCP 3306

mysql_galera TCP 4444

mysql_galera TCP 4567

mysql_galera TCP 4568

mysql_galera TCP 9200 Galera-monitor

1.13. MONGODB

Service Protocol Ports Notes

mongodb_config TCP 27019 mongodb_config

mongodb_sharding TCP 27018 mongodb_sharding

5
Red Hat OpenStack Platform 13 Firewall Rules for Red Hat OpenStack Platform

Service Protocol Ports Notes

mongodb TCP 27017 MongoDB

1.14. NTP

Service Protocol Ports Notes

ntp UDP 123 NTP

1.15. SWIFT STORAGE

Service Protocol Ports Notes

swift TCP 873 Rsync

swift TCP 6000 Object Server

swift TCP 6001 Container Server

swift TCP 6002 Account Server

1.16. CEPH OSD

Service Protocol Ports Notes

ceph TCP 6800-7300

1.17. NEUTRON L3

Service Protocol Ports Notes

VRRP VRRP VRRP

1.18. HEAT CLOUDFORMATION API SERVICE

Service Protocol Ports Notes

heat TCP 8000 Heat AWS

CloudFormation-
compatible API

6
 CHAPTER 1. FIREWALL RULES FOR RED HAT OPENSTACK PLATFORM

Service Protocol Ports Notes

heat TCP 13800 Heat AWS

CloudFormation-
compatible API (SSL)

1.19. GNOCCHI API

Service Protocol Ports Notes

gnocchi TCP 8041 Gnocchi API

gnocchi TCP 13041 Gnocchi API (SSL)

1.20. GNOCCHI STATSD

Service Protocol Ports Notes

gnocchi_statsd UDP 8125 Network daemon for

statistics

1.21. NEUTRON DHCP

Service Protocol Ports Notes

neutron_DHCP UDP 67 Provisioning the

Overcloud

neutron_DHCP UDP 68

1.22. CEILOMETER SNMP

Service Protocol Ports Notes

SNMP UDP 161 Ceilometer

1.23. HEAT API

Service Protocol Ports Notes

heat TCP 8004 Heat API Endpoint

7
Red Hat OpenStack Platform 13 Firewall Rules for Red Hat OpenStack Platform

Service Protocol Ports Notes

heat TCP 13004 Heat API Endpoint (SSL)

1.24. NEUTRON OVS AGENT

Service Protocol Ports Notes

neutron_vxlan UDP 4789 VXLAN

neutron_vxlan GRE GRE

1.25. SWIFT PROXY

Service Protocol Ports Notes

swift TCP 8080 Swift Proxy

swift TCP 13808 Swift Proxy (SSL)

1.26. HEAT AWS CLOUDWATCH-COMPATIBLE API

Service Protocol Ports Notes

heat TCP 8003 Heat AWS CloudWatch-

compatible API

heat TCP 13003 Heat AWS CloudWatch-

compatible API (SSL)

1.27. MEMCACHED SERVICE

Service Protocol Ports Notes

memcached TCP 11211

1.28. CEPH MONITOR SERVICE

Service Protocol Ports Notes

ceph TCP 6789

8
 CHAPTER 1. FIREWALL RULES FOR RED HAT OPENSTACK PLATFORM

1.29. CEPH RADOSGW SERVICE

Service Protocol Ports Notes

ceph_rgw TCP 8080 Ceph RGW

ceph_rgw TCP 13080 Ceph RGW (SSL)

1.30. CINDER API

Service Protocol Ports Notes

cinder TCP 8776 Cinder API

cinder TCP 13776 Cinder API (SSL)

1.31. CINDER VOLUME ISCSI INITIATOR

Service Protocol Ports Notes

iSCSI TCP 3260

1.32. IRONIC API

Service Protocol Ports Notes

ironic TCP 6385 Ironic API

ironic TCP 13385 Ironic API (SSL)

1.33. PACEMAKER

Service Protocol Ports Notes

pacemaker TCP 2224

pacemaker TCP 3121

pacemaker TCP 21064

pacemaker UDP 5405

9
Red Hat OpenStack Platform 13 Firewall Rules for Red Hat OpenStack Platform

1.34. SAHARA API

Service Protocol Ports Notes

sahara TCP 8386 Sahara API

sahara TCP 13386 Sahara API (SSL)

1.35. NEUTRON API

Service Protocol Ports Notes

neutron TCP 9696 Neutron API

neutron TCP 13696 Neutron API (SSL)

1.36. HORIZON

Service Protocol Ports Notes

horizon TCP 80 Dashboard

horizon TCP 443 Dashboard (SSL)

1.37. AODH API

Service Protocol Ports Notes

aodh_api TCP 8042

aodh_api TCP 13042

1.38. MANILA API

Service Protocol Ports Notes

manila TCP 8786 Manila API

manila TCP 13786 Manila API

10
CHAPTER 1. FIREWALL RULES FOR RED HAT OPENSTACK PLATFORM

11