RE: firewalld configuration for EPICS?

[Mark Rivers via Tech-talk <tech-talk at aps.anl.gov>]

Folks,

 

• Is it sufficient to follow these instructions?
• https://epics-controls.org/resources-and-support/documents/howto-documents/configure-channel-access/#Firewalls
• Or do the multiple IOCs require additional complexity?

 

I have now empirically answered that question, and it is NOT sufficient to implement the firewall rules documented in the CA Reference Manual.  When I do that, I can only connect to the first IOC I start.

 

Is there a recipe for configuring the firewall when multiple IOCs are running on that Linux machine?  I can access all IOCs from CA clients running on that same machine, but not from clients running on other machines.

 

Thanks,

Mark

 

 

From: Mark Rivers
Sent: Monday, June 3, 2024 3:26 PM
To: EPICS Tech Talk <tech-talk at aps.anl.gov>
Subject: RE: firewalld configuration for EPICS?

 

Folks,

 

We would like to start to enable the firewalls on our Linux machines that are running Linux IOCs and clients.

 

The only “official” documentation I can find is the most recent CA Reference Manual:

https://epics.anl.gov/base/R7-0/8-docs/CAref.html#firewall

 

And in “How to Configure Channel Access”:

https://epics-controls.org/resources-and-support/documents/howto-documents/configure-channel-access/#Firewalls

 

Both of these are very terse, and do not explicitly discuss the case of multiple IOCs on a Linux server.

 

The tech-talk thread I am responding to did not reach a clear conclusion and recommendation.

 

My configuration is as follows:

• RHEL 9 servers running multiple IOCs
• All clients are either on that server or other machines on the same subnet.  Thus, CA searches can simply use broadcasts, and we don’t need to use the IP Tables mechanism.

 

Is it sufficient to follow these instructions?

https://epics-controls.org/resources-and-support/documents/howto-documents/configure-channel-access/#Firewalls

 

Or do the multiple IOCs require additional complexity?

 

Thanks,

Mark

 

 

From: Tech-talk <tech-talk-bounces at aps.anl.gov> On Behalf Of Ralph Lange via Tech-talk
Sent: Friday, February 28, 2020 4:26 AM
To: EPICS Tech Talk <tech-talk at aps.anl.gov>
Subject: Re: firewalld configuration for EPICS?

 

Small note:

 

On Mon, 24 Feb 2020 at 14:10, Goetz Pfeiffer via Tech-talk <tech-talk at aps.anl.gov> wrote:

Settings for EPICS clients:

  firewall-cmd --add-rich-rule="rule source-port port=5064 protocol=tcp accept"
  firewall-cmd --add-rich-rule="rule source-port port=5064 protocol=udp accept"
  firewall-cmd --add-rich-rule="rule source-port port=5065 protocol=tcp accept"
  firewall-cmd --add-rich-rule="rule source-port port=5065 protocol=udp accept"

Additional settings for EPICS servers:

  firewall-cmd --add-rich-rule="rule port port=5064 protocol=tcp accept"
  firewall-cmd --add-rich-rule="rule port port=5064 protocol=udp accept"
  firewall-cmd --add-rich-rule="rule port port=5065 protocol=tcp accept"
  firewall-cmd --add-rich-rule="rule port port=5065 protocol=udp accept"

 

Channel Access does not use TCP on the beacon port (aka CA_REPEATER_PORT, ca-2, 5065). Opening it does no harm, but is not needed.

Reference: https://docs.epics-controls.org/en/latest/specs/ca_protocol.html

 

Cheers,
~Ralph