Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable Firewall on Node, Add Windows Firewall rules for required ports #1

Closed
wants to merge 1 commit into from
Closed

Enable Firewall on Node, Add Windows Firewall rules for required ports #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions parts/kuberneteswindowssetup.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,8 +201,17 @@ Get-PodGateway(`$podCIDR)
function
Set-DockerNetwork(`$podCIDR)
{
# Turn off Firewall to enable pods to talk to service endpoints. (Kubelet should eventually do this)
netsh advfirewall set allprofiles state off
# Windows Firewall rules to allow only Master to access Node's kubelet ports
# Firewall rules to allow access to container's websockets
netsh advfirewall firewall add rule name="Container: Allow access to node localport 8080" dir=in action=allow protocol=TCP localport=8080
netsh advfirewall firewall add rule name="Container: Allow access to node localport 8888" dir=in action=allow protocol=TCP localport=8888
netsh advfirewall firewall add rule name="Container: Allow UDP inbound traffic for Container DNS Port 53" dir=in action=allow localport=53 protocol=UDP
netsh advfirewall firewall add rule name="Node: Allow only K8 Master to access localport 4194" dir=in action=allow protocol=TCP localport=4194 remoteip=`${global:MasterIP}
netsh advfirewall firewall add rule name="Node: Allow only K8 Master to access localport 10250" dir=in action=allow protocol=TCP localport=10250 remoteip=`${global:MasterIP}
netsh advfirewall firewall add rule name="Node: Allow only K8 Master to access localport 10255" dir=in action=allow protocol=TCP localport=10255 remoteip=`${global:MasterIP}

# Turn-on the firewall since we have allowed access to required ports
netsh advfirewall set allprofiles state on

`$dockerTransparentNet=docker network ls --quiet --filter "NAME=`$global:TransparentNetworkName"
if (`$dockerTransparentNet.length -eq 0)
Expand Down Expand Up @@ -399,4 +408,4 @@ try
catch
{
Write-Error $_
}
}