RE: firewalld configuration for EPICS?

[Abdalla Ahmad via Tech-talk <tech-talk@aps.anl.gov>]

Hello Mark

 

We have similar setup to yours, multiple IOCs on a server and clients on different machines, same and different subnets. For the same subnet we use the UDP broadcast rule mentioned here, you don’t need the whole script, just run the iptables rule in the “up” mode section on startup and you’re good to go. For clients on different subnets, I think you need to have an EPICS gateway, one for each subnet. Another option you can use, as Freddie pointed out, is to have the IOCs listen on the loopback and one EPICS gateway running on port 5064.

 

Please note that the previous is working when adding the NIC to the trusted zone in Rocky Linux 8, I tried working on configuring the firewall to work with our setup, some IOCs work and others didn’t. But as I am writing this, I think if you add an EPICS gateway to each server listening on port 5064, you could have the firewall working while allowing ports 5064 and 5065 both TCP and UDP.

 

Best Regards,

Abdalla.

 

From: Tech-talk <tech-talk-bounces@aps.anl.gov> On Behalf Of Mark Rivers via Tech-talk
Sent: Tuesday, June 4, 2024 2:04 AM
To: EPICS Tech Talk <tech-talk@aps.anl.gov>
Subject: RE: firewalld configuration for EPICS?

 

Folks,

 

Ø  Is it sufficient to follow these instructions?

Ø  https://epics-controls.org/resources-and-support/documents/howto-documents/configure-channel-access/#Firewalls

Ø  Or do the multiple IOCs require additional complexity?

 

I have now empirically answered that question, and it is NOT sufficient to implement the firewall rules documented in the CA Reference Manual.  When I do that, I can only connect to the first IOC I start.

 

Is there a recipe for configuring the firewall when multiple IOCs are running on that Linux machine?  I can access all IOCs from CA clients running on that same machine, but not from clients running on other machines.

 

Thanks,

Mark

 

 

From: Mark Rivers
Sent: Monday, June 3, 2024 3:26 PM
To: EPICS Tech Talk <tech-talk@aps.anl.gov>
Subject: RE: firewalld configuration for EPICS?

 

Folks,

 

We would like to start to enable the firewalls on our Linux machines that are running Linux IOCs and clients.

 

The only “official” documentation I can find is the most recent CA Reference Manual:

https://epics.anl.gov/base/R7-0/8-docs/CAref.html#firewall

 

And in “How to Configure Channel Access”:

https://epics-controls.org/resources-and-support/documents/howto-documents/configure-channel-access/#Firewalls

 

Both of these are very terse, and do not explicitly discuss the case of multiple IOCs on a Linux server.

 

The tech-talk thread I am responding to did not reach a clear conclusion and recommendation.

 

My configuration is as follows:

-          RHEL 9 servers running multiple IOCs

-          All clients are either on that server or other machines on the same subnet.  Thus, CA searches can simply use broadcasts, and we don’t need to use the IP Tables mechanism.

 

Is it sufficient to follow these instructions?

https://epics-controls.org/resources-and-support/documents/howto-documents/configure-channel-access/#Firewalls

 

Or do the multiple IOCs require additional complexity?

 

Thanks,

Mark

 

 

From: Tech-talk <tech-talk-bounces@aps.anl.gov> On Behalf Of Ralph Lange via Tech-talk
Sent: Friday, February 28, 2020 4:26 AM
To: EPICS Tech Talk <tech-talk@aps.anl.gov>
Subject: Re: firewalld configuration for EPICS?

 

Small note:

 

On Mon, 24 Feb 2020 at 14:10, Goetz Pfeiffer via Tech-talk <tech-talk@aps.anl.gov> wrote:

Settings for EPICS clients:

  firewall-cmd --add-rich-rule="rule source-port port=5064 protocol=tcp accept"
  firewall-cmd --add-rich-rule="rule source-port port=5064 protocol=udp accept"
  firewall-cmd --add-rich-rule="rule source-port port=5065 protocol=tcp accept"
  firewall-cmd --add-rich-rule="rule source-port port=5065 protocol=udp accept"

Additional settings for EPICS servers:

  firewall-cmd --add-rich-rule="rule port port=5064 protocol=tcp accept"
  firewall-cmd --add-rich-rule="rule port port=5064 protocol=udp accept"
  firewall-cmd --add-rich-rule="rule port port=5065 protocol=tcp accept"
  firewall-cmd --add-rich-rule="rule port port=5065 protocol=udp accept"

 

Channel Access does not use TCP on the beacon port (aka CA_REPEATER_PORT, ca-2, 5065). Opening it does no harm, but is not needed.

Reference: https://docs.epics-controls.org/en/latest/specs/ca_protocol.html

 

Cheers,
~Ralph