firewall-cmd --permanent --add-masquerade
firewall-cmd --permanent --add-port=6443/tcp        # Kubernetes API Server
firewall-cmd --permanent --add-port=2379-2380/tcp   # etcd server client API
firewall-cmd --permanent --add-port=10250/tcp       # Kubelet API
firewall-cmd --permanent --add-port=10259/tcp       # kube-scheduler
firewall-cmd --permanent --add-port=10257/tcp       # kube-controller-manager
firewall-cmd --permanent --add-port=8472/udp        # Flannel VXLAN overlay
firewall-cmd --permanent --add-port=51820/udp       # Flannel WireGuard (optional/fallback)
firewall-cmd --permanent --zone=trusted --add-source=10.3.0.0/24      # Lab Node Subnet
firewall-cmd --permanent --zone=trusted --add-source=10.244.0.0/16    # Pod CIDR
firewall-cmd --permanent --zone=trusted --add-source=10.96.0.0/12     # Service CIDR
firewall-cmd --permanent --zone=trusted --add-interface=cni0
firewall-cmd --permanent --zone=trusted --add-interface=flannel.1
firewall-cmd --reload
firewall-cmd --permanent --add-masquerade
firewall-cmd --permanent --add-port=6443/tcp        # API Server
firewall-cmd --permanent --add-port=2379-2380/tcp   # etcd
firewall-cmd --permanent --add-port=10250/tcp       # Kubelet API
firewall-cmd --permanent --add-port=10259/tcp       # kube-scheduler
firewall-cmd --permanent --add-port=10257/tcp       # kube-controller-manager
firewall-cmd --permanent --add-port=179/tcp         # Calico BGP
firewall-cmd --permanent --add-port=4789/udp        # Calico VXLAN (if used instead of IPIP)
firewall-cmd --permanent --add-port=5473/tcp        # Typha (for large clusters)
firewall-cmd --permanent --add-protocol=ipip        # Calico IP-in-IP encapsulation
firewall-cmd --permanent --zone=trusted --add-source=10.4.0.0/24      # Node Network
firewall-cmd --permanent --zone=trusted --add-source=192.168.0.0/16   # Calico Pod CIDR
firewall-cmd --permanent --zone=trusted --add-source=10.96.0.0/12     # Service CIDR
firewall-cmd --permanent --zone=trusted --add-interface=cali+
firewall-cmd --permanent --zone=trusted --add-interface=tunl0
firewall-cmd --permanent --zone=trusted --add-interface=vxlan.calico
firewall-cmd --reload