Skip to main content

Configure the host firewall

A host firewall enables you to view the services used by a host and the port numbers for

the services and set the IP addresses that are allowed to access specific port numbers. It can effectively control network access and prevent unauthorized access and attacks to protect hosts. A host firewall provides the following features:

• Displaying the built-in and custom services running on a host and the port numbers for the services, and the IP addresses allowed to access the services.

• Changing allowed IP addresses: You can configure the IP addresses that are allowed to access port numbers through the host firewall, thus limiting the scope of network access. For example, you can allow 192.168.1.100/16 to access the SSH service on the host, corresponding to port number 22.

• Adding custom ports and IP addresses that can access the ports.

• Configure the access limit type when IP addresses that can access the ports are specified.

• Setting a list of IP addresses allowed to access specific ports on a host. For example, you can configure 192.168.1.100/16 to access the SSH service with port number 22 on a host. You can set a list of allowed IP addresses for each port number. For example, you can allow 192.168.1.200/16 and 192.168.1.201/16 to access the virtualization Web service with a port number of 80 on the host, and allow 172.16.1.100/16 to access the HTTPS service with a port number of 8443 on the host.

Restrictions and guidelines

• If an IP address can access the management platform through HTTPS, it can still access the VNC Web service even if it is not in the allowed IP address list for the VNC Web service.

• The firewall feature is not available for hosts that use software versions E073x and E076x.

• A host firewall only identifies and limits the incoming traffic of hosts.

• Deleting a host also deletes the firewall configuration for that host. After you change the IP address of a host from the XConsole of that host, you must restart that host to update the firewall configuration. If you fail to do so, the original allowed IP addresses will remain in the allowed IP address list for all ports.

• If a stateful failover system is deployed, make sure port 22 of the quorum node is reachable to the other nodes. The host firewall configuration in stateful failover management takes effect only on the primary and backup nodes and does not take effect on the quorum node.

• After a host is restored after stateful failover, you must click Synchronize in the firewall configuration in stateful failover management to synchronize the firewall configuration.

• To avoid affecting features running on the system, use the following table when you set the list of allowed IP addresses. Recommended Feature Description operations Make sure the quorum node is reachable to the primary and Allow the relevant ports or backup nodes. Setting up a disable the host firewall, Stateful failover stateful failover system requires and then set up a stateful use of ports 22, 20136, and failover system. 20138 of the primary and backup nodes. Major cloud To interoperate with major cloud Open all ports to IP

product or products such as NCloud, or addresses related to third-party third-party software such as major cloud products or interoperation AnyBackup of Aishu and third-party software. Runstor, allow relevant IP addresses to access ports such as HTTP services.

Port 8080 or 8443 is required Adding an when the NSphere system or Open ports 8080 and external platform Usphere is added as an external 8443. platform. When copying files from the Bare metal management host to a bare Open port 22. management metal server, the SCP service is required. Site disaster recovery requires Site disaster use of ports 8080 and 8443 for Open ports 8080 and recovery the protected site and the 8443. recovery site.

Same as major cloud Same as major cloud product or Anti-virus product or third-party third-party interoperation. interoperation.

Site incorporation and VM Open ports 8080, 8443, migration require use of ports Cloud rainbow 22, 20199, and ports 8080, 8443, 22, 20199, and 49152 to 49215. ports 49152 to 49215.

Management Management platform data Open ports 8080, 8443, platform data migration requires use of ports and 22. migration 8080, 8443, and 22.

Log backup requires use of port Log backup Open port 22. 22 on the destination.

Data backup on Data backup requires use of port a remote server Open port 22. 22 on the destination. in backup

management

The management platform manages hosts and VMs on the Host Open ports 26165 and hosts by calling ports 26165 and management 26167. 26167 of the host management platform. The host scanning feature during cluster creation requires Scanning hosts Open port 8081. the use of port 8081 of the management platform.

Enable or disable the host firewall function

  1. On the top navigation bar, click Security.

  2. From the left navigation pane, select Host Firewall.

  3. Enable or disable host firewall. If you disable the host firewall function, all ports on a physical host can be accessed. If you enable the host firewall, only the specified ports can be accessed according to the configured direction and access limit type.

View host firewall settings

  1. On the top navigation bar, click Security.

  2. From the left navigation pane, select Host Firewall.

  3. View the host firewalls and associated hosts.

Add a host firewall

  1. On the top navigation bar, click Security.

  2. From the left navigation pane, select Host Firewall.

  3. Click Add, and configure the following parameters:

    ○ Name: Enter a name for the host firewall.

    ○ Direction: Select a direction for traffic limiting. You can select Inbound, Outbound, or both.

    ○ Description: Enter a description for the host firewall.

    ○ Protocol: Select a protocol to limit. You can select TCP, UDP, or both.

    ○ Port: Enter ports and port ranges separated by semicolons.

  4. Click OK.

Associate a host firewall with hosts

  1. On the top navigation bar, click Security.

  2. From the left navigation pane, select Host Firewall.

  3. Click Associate Host in the Actions column for a host firewall, or select a host firewall and click Add in the Associated Hosts area. On the window that opens, configure the following parameters:

    ○ Access Limit Type: Select an access limit type:

    ▪ Allow All: All addresses can access the specified ports.

    ▪ Internal Only: Only the hosts on the management platform can access the specified ports.

    ▪ Allowlist: Only the hosts on the management platform and the IP addresses in the allowlist can access the specified ports.

    ▪ Denylist: Only the hosts on the management platform and the IP addresses not in the denylist can access the specified ports.

    ○ Select Host: Select hosts when the access limit type is Allow All, Allowlist, or Denylist. In a hot backup scenario, after you associate one node, the other node is associated automatically.

  4. Click OK.

Edit a host firewall

  1. On the top navigation bar, click Security.

  2. From the left navigation pane, select Host Firewall.

  3. Click Edit in the Actions column for a host firewall, and configure the following parameters in the dialog box that opens:

    ○ Direction: Select a direction for traffic limiting. You can select Inbound, Outbound, or both.

    ○ Description: Enter a description for the host firewall.

    ○ Protocol: Select a protocol to limit. You can select TCP, UDP, or both.

    ○ Port: Enter ports and port ranges separated by semicolons.

  4. Click OK.

Delete host firewalls

  1. On the top navigation bar, click Security.

  2. From the left navigation pane, select Host Firewall.

  3. Click Delete in the Actions column for a host firewall, or select multiple host firewalls and click Delete.

  4. In the dialog box that opens, click OK.

Edit the access limit type

  1. On the top navigation bar, click Security.

  2. From the left navigation pane, select Host Firewall.

  3. Select host firewalls.

  4. Click Edit in the Actions column for a host, or select multiple hosts and click Edit.

  5. In the dialog box that opens, edit the access limit type.

    ○ Allow All: All addresses can access the specified ports.

    ○ Internal Only: Only the hosts on the management platform can access the specified ports.

    ○ Allowlist: Only the hosts on the management platform and the IP addresses in the allowlist can access the specified ports.

    ○ Denylist: Only the hosts on the management platform and the IP addresses not in the denylist can access the specified ports.

  6. Click OK

Synchronize host firewall settings

  1. On the top navigation bar, click Security.

  2. From the left navigation pane, select Host Firewall.