Super User
32 lines
2.1 KiB
Bash
32 lines
2.1 KiB
Bash
firewall-cmd --permanent --add-masquerade
|
|
firewall-cmd --permanent --add-port=6443/tcp # Kubernetes API Server
|
|
firewall-cmd --permanent --add-port=2379-2380/tcp # etcd server client API
|
|
firewall-cmd --permanent --add-port=10250/tcp # Kubelet API
|
|
firewall-cmd --permanent --add-port=10259/tcp # kube-scheduler
|
|
firewall-cmd --permanent --add-port=10257/tcp # kube-controller-manager
|
|
firewall-cmd --permanent --add-port=8472/udp # Flannel VXLAN overlay
|
|
firewall-cmd --permanent --add-port=51820/udp # Flannel WireGuard (optional/fallback)
|
|
firewall-cmd --permanent --zone=trusted --add-source=10.3.0.0/24 # Lab Node Subnet
|
|
firewall-cmd --permanent --zone=trusted --add-source=10.244.0.0/16 # Pod CIDR
|
|
firewall-cmd --permanent --zone=trusted --add-source=10.96.0.0/12 # Service CIDR
|
|
firewall-cmd --permanent --zone=trusted --add-interface=cni0
|
|
firewall-cmd --permanent --zone=trusted --add-interface=flannel.1
|
|
firewall-cmd --reload
|
|
firewall-cmd --permanent --add-masquerade
|
|
firewall-cmd --permanent --add-port=6443/tcp # API Server
|
|
firewall-cmd --permanent --add-port=2379-2380/tcp # etcd
|
|
firewall-cmd --permanent --add-port=10250/tcp # Kubelet API
|
|
firewall-cmd --permanent --add-port=10259/tcp # kube-scheduler
|
|
firewall-cmd --permanent --add-port=10257/tcp # kube-controller-manager
|
|
firewall-cmd --permanent --add-port=179/tcp # Calico BGP
|
|
firewall-cmd --permanent --add-port=4789/udp # Calico VXLAN (if used instead of IPIP)
|
|
firewall-cmd --permanent --add-port=5473/tcp # Typha (for large clusters)
|
|
firewall-cmd --permanent --add-protocol=ipip # Calico IP-in-IP encapsulation
|
|
firewall-cmd --permanent --zone=trusted --add-source=10.4.0.0/24 # Node Network
|
|
firewall-cmd --permanent --zone=trusted --add-source=192.168.0.0/16 # Calico Pod CIDR
|
|
firewall-cmd --permanent --zone=trusted --add-source=10.96.0.0/12 # Service CIDR
|
|
firewall-cmd --permanent --zone=trusted --add-interface=cali+
|
|
firewall-cmd --permanent --zone=trusted --add-interface=tunl0
|
|
firewall-cmd --permanent --zone=trusted --add-interface=vxlan.calico
|
|
firewall-cmd --reload
|