---
title: Install with Firewalld Enabled
slug: install-10x/install-with-firewalld-enabled
docTags: 
createdAt: 2025-07-16T13:29:40.590Z
---

By default, the installer requires that Firewalld is disabled before continuing. If you need to leave Firewalld enabled you can add a flag (under the firewalldConfig spec) to the installer-override.yaml patch file `spec:` section.

For example:

:::BlockQuote
apiVersion: cluster.kurl.sh/v1beta1
kind: Installer
metadata:
  name: "patch"
spec:
  firewalldConfig:
    bypassFirewalldWarning: true
:::

## Configuring Firewalld

The required ports for cluster node communication need to be open in the Firewalld config on each node in the cluster. For more information see [System Requirements for an Embedded Cluster Install](docId\:LD6YzgAX-gPbBdT2c1h3S).

Here is an example script for configuring Firewalld in CentOS 7/RHEL 7 environments:

:::BlockQuote
\#!/bin/bash
echo 'net.ipv4.ip\_forward = 1' | tee -a /etc/sysctl.conf;

sysctl -p;

firewall-cmd --permanent --zone=external --add-masquerade;

firewall-cmd --permanent --zone=trusted --add-interface=cni0;

\# SSH Port
firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="22" accept';

\# HTTP Port (optional - used to redirect to HTTPS)
firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="80" accept';

\# HTTPS Port
firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="443" accept';

\# Kubernetes etcd Port
firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="2379-2380" accept';

\# Kubernetes API Port
firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="6443" accept';

\# Flannel VXLAN Port
firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="udp" port="8472" accept';

\# KOTS UI Port
firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="8800" accept';

\# Kubernetes Component (kubelet, kube-scheduler, kube-controller) Ports
firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="10250-10252" accept';

firewall-cmd --reload

:::

If you wish to open additional ports after the Swimlane deployment (e.g. Syslog Receiver, External Mongo ports) see below:

`kubectl get svc -o wide`

:::BlockQuote
NAME                           TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)           AGE    SELECTOR
kotsadm                        ClusterIP   10.96.3.36    \<none>        3000/TCP          3d     app=kotsadm
kotsadm-postgres               ClusterIP   10.96.3.188   \<none>        5432/TCP          3d     app=kotsadm-postgres
kubernetes                     ClusterIP   10.96.0.1     \<none>        443/TCP           3d1h   \<none>
kurl-proxy-kotsadm             NodePort    10.96.1.64    \<none>        8800:8800/TCP     3d     app=kurl-proxy-kotsadm
sw-api                         ClusterIP   10.96.2.47    \<none>        5000/TCP          3d     service=swimlane-api
sw-web                         ClusterIP   10.96.2.67    \<none>        443/TCP           3d     service=swimlane-web
swimlane-chrome                ClusterIP   10.96.3.32    \<none>        4444/TCP          3d     service=swimlane-chrome
swimlane-sw-mongo              ClusterIP   None          \<none>        27017/TCP         3d     app=sw-mongo,release=swimlane
swimlane-sw-mongo-0-external   NodePort    10.96.0.224   \<none>        27017:35246/TCP   3d     statefulset.kubernetes.io/pod-name=swimlane-sw-mongo-0
swimlane-sw-mongo-1-external   NodePort    10.96.1.229   \<none>        27017:6239/TCP    3d     statefulset.kubernetes.io/pod-name=swimlane-sw-mongo-1
swimlane-sw-mongo-2-external   NodePort    10.96.0.104   \<none>        27017:36278/TCP   3d     statefulset.kubernetes.io/pod-name=swimlane-sw-mongo-2
swimlane-syslog-receiver       NodePort    10.96.2.119   \<none>        514:42750/UDP     3d     service=swimlane-syslog-receiver
:::

The ports from the example output above will be different for every deployment. Run these commands to create firewall exceptions:

TCP ports 35246, 6239, 36278 have been assigned to our MongoDB service for external access:

:::BlockQuote
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" port protocol="tcp" port="35246" accept'
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" port protocol="tcp" port="6239" accept'
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" port protocol="tcp" port="36278" accept'
:::

UDP port 42750 has been assigned to our Swimlane Syslog Receiver service:

:::BlockQuote
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" port protocol="udp" port="42750" accept'
:::

Restart firewalld:

:::BlockQuote
sudo firewall-cmd --reload
:::

See [Overriding Installer Settings](docId\:X7jKIJjG4IP6y3FqQqxyI) for instructions on how to specify the installer override file during the install and join node commands.