Re: firewalld configuration for EPICS?

["Johnson, Andrew N. via Tech-talk" <tech-talk@aps.anl.gov>]

I believe the CA client library uses tcp port 5065 for clients to make connections to their local CA repeater process (through which the repeater forwards copies of all incoming beacons to those clients). Thus it is not necessary to open that port to the outside world, but  it is essential to the protocol (sorry to be pedantic!).

- Andrew

-- 

Sent from my iPad

On Apr 4, 2019, at 2:28 PM, Ralph Lange via Tech-talk <tech-talk@aps.anl.gov> wrote:

Minor comment:

Channel Access uses port ca-2 (5065) only for beacon messages which are UDP, so it is not really necessary to open ca-2/tcp.

Cheers,
~Ralph

On Wed, 3 Apr 2019 at 14:08, Jörn Dreyer via Tech-talk <tech-talk@aps.anl.gov> wrote:

Am Mittwoch, 3. April 2019, 11:51:11 CEST schrieb Dirk Zimoch via Tech-talk:
> Hi
>
> Does anyone already have a firewalld configuration to allow Channel
> Access? I.e. something like a /usr/lib/firewalld/services/epics.xml file?
>
> Dirk

Hi Dirk,

you could use the following as a EPICS.xml under /etc/firewalld/services

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>EPICS Channel Access service</short>
  <port port="ca-1" protocol="tcp"/>
  <port port="ca-1" protocol="udp"/>
  <port port="ca-2" protocol="tcp"/>
  <port port="ca-2" protocol="udp"/>
  <source-port port="ca-1" protocol="tcp"/>
  <source-port port="ca-1" protocol="udp"/>
  <source-port port="ca-2" protocol="tcp"/>
  <source-port port="ca-2" protocol="udp"/>
</service>

And then select EPICS for the zone you need to enable the ports.

Regards,

Jörn