Re: Firewall (iptables) issues?

[Ralph Lange <Ralph.Lange@bessy.de>]

 On 05.11.2010 11:28, Eric Norum wrote:
> To summarize:
>
> If you want channel access clients on a machine to be able to see replies to broadcast PV search requests you need to permit inbound UDP packets with source port EPICS_CA_SERVER_PORT (default is 5064).  On systems using iptables this can be accomplished by a rule like
> 	-A INPUT -s 192.168.0.0/22 -p udp --sport 5064 -j ACCEPT
>
> If you want channel access servers (e.g. "soft IOCs") on a machine to be able to see clients you need to permit inbound TCP and UDP packets with source port EPICS_CA_SERVER_PORT (default is 5064).  On systems using iptables this can be accomplished by rules like
> 	-A INPUT -s 192.168.0.0/22 -p udp --dport 5064 -j ACCEPT
> 	-A INPUT -s 192.168.0.0/22 -p tcp --dport 5064 -j ACCEPT
>
>
> In all cases the "-s 192.168.0.0/22" specifies the range of addresses from which you wish to accept packets.

Don't forget:

If you run caRepeater on a machine, so that your client applications are 
able to see beacons from IOCs, and can detect connection loss and new 
IOCs coming online, you need to permit inbound UDP packets with source 
port EPICS_CA_REPEATER_PORT (default is 5065). On systems using iptables 
this can be accomplished by a rule like

-A INPUT -s 192.168.0.0/22 -p udp --sport 5065 -j ACCEPT

(Only necessary if your firewall does not allow all outgoing traffic by 
default:)
If you want channel access servers (e.g. "soft IOCs") on a machine to be 
able to send beacons, so that their clients can detect connection loss 
and your IOCs starting up, you need to permit outbound UDP packets with 
source port EPICS_CA_REPEATER_PORT (default is 5065). On systems using 
iptables this can be accomplished by a rule like

-A OUTPUT -p udp --dport 5065 -j ACCEPT

Cheers,
Ralph