Red Hat OpenStack Platform 16.

Firewall Rules for Red Hat OpenStack Platform

List of required ports and protocols.

Last Updated: 2021-12-10

Red Hat OpenStack Platform 16.2 Firewall Rules for Red Hat OpenStack
Platform
List of required ports and protocols.

OpenStack Team
[email protected]
Legal Notice
Copyright © 2021 Red Hat, Inc.

The text of and illustrations in this document are licensed by Red Hat under a Creative Commons
Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is
available at
http://creativecommons.org/licenses/by-sa/3.0/
. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must
provide the URL for the original version.

Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert,
Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.

Red Hat, Red Hat Enterprise Linux, the Shadowman logo, the Red Hat logo, JBoss, OpenShift,
Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States
and other countries.

Linux ® is the registered trademark of Linus Torvalds in the United States and other countries.

Java ® is a registered trademark of Oracle and/or its affiliates.

XFS ® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States
and/or other countries.

MySQL ® is a registered trademark of MySQL AB in the United States, the European Union and
other countries.

Node.js ® is an official trademark of Joyent. Red Hat is not formally related to or endorsed by the
official Joyent Node.js open source or commercial project.

The OpenStack ® Word Mark and OpenStack logo are either registered trademarks/service marks
or trademarks/service marks of the OpenStack Foundation, in the United States and other
countries and are used with the OpenStack Foundation's permission. We are not affiliated with,
endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.

All other trademarks are the property of their respective owners.

Abstract
This document describes Red Hat OpenStack platform firewall rules and network flows.
 Table of Contents

Table of Contents
. . . . . . . . . .OPEN
MAKING . . . . . . SOURCE
. . . . . . . . . .MORE
. . . . . . .INCLUSIVE
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3. . . . . . . . . . . . .

.CHAPTER
. . . . . . . . . . 1.. .FIREWALL
. . . . . . . . . . . RULES
. . . . . . . .FOR
. . . . .RED
. . . . .HAT
. . . . .OPENSTACK
. . . . . . . . . . . . . PLATFORM
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4. . . . . . . . . . . . .
1.1. USING THE RED HAT OPENSTACK NETWORK FLOW MATRIX 4

1
Red Hat OpenStack Platform 16.2 Firewall Rules for Red Hat OpenStack Platform

2
 MAKING OPEN SOURCE MORE INCLUSIVE

MAKING OPEN SOURCE MORE INCLUSIVE

Red Hat is committed to replacing problematic language in our code, documentation, and web
properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. Because of the
enormity of this endeavor, these changes will be implemented gradually over several upcoming releases.
For more details, see our CTO Chris Wright’s message .

3
Red Hat OpenStack Platform 16.2 Firewall Rules for Red Hat OpenStack Platform

CHAPTER 1. FIREWALL RULES FOR RED HAT OPENSTACK

PLATFORM
This document includes a link to the Red Hat OpenStack network flow matrix. The matrix describes
network flows created by the director on Red Hat OpenStack Platform. These ports are used by services
running on the overcloud. Use this information to help you define firewall rules.

1.1. USING THE RED HAT OPENSTACK NETWORK FLOW MATRIX

The network flow matrix is a comma separated values (CSV) file that describes flows to and from
OpenStack services.

NOTE

The network flow matrix describes common traffic flows. It does not describe every
possible flow. Some flows that are not described in this matrix might be critical to
operation. For instance, if you block all traffic and then selectively open only the flows
described here, you might unintentionally block a necessary flow. That could cause issues
that are difficult to troubleshoot.

Procedure

1. Use the following link to download the matrix:

Red Hat OpenStack Network Flows .

For instance, right click the link and choose Save link as.

2. Use the information in the file to help you formulate firewall rules. The matrix describes flows in
the following columns.

Service
The OpenStack service.
Protocol
Transmission protocol.
Dest. Port
Destination port.
Source Object
Source of data.
Dest. Object
Destination of data.
Source/Dest Pairs
Valid source and destination pairs.
Dest. Network
Destination network.
ServiceNetMap Parent
Determines the network type used for each service.
Traffic Description
Notes about the traffic flow.

4
CHAPTER 1. FIREWALL RULES FOR RED HAT OPENSTACK PLATFORM