---
title: Swimlane HA K8s firewall rules
slug: install-10x/swimlane-ha-k8s-firewall-rules
docTags: 
createdAt: 2025-12-15T08:17:08.364Z
---

This document provides the list of all known connections that Swimlane K8s requires to run. The ports listed below need to be opened on masters/workers nodes.

Note: Any additional services are not listed here.

| **Protocol** | **Direction** | **Port Range** | **Purpose**                                          |
| ------------ | ------------- | -------------- | ---------------------------------------------------- |
| TCP          | Inbound       | 22             | SSH                                                  |
| TCP          | Inbound       | 443            | Swimlane application                                 |
| TCP          | Inbound       | 6443           | Kubernetes API server                                |
| TCP          | Inbound       | 2379-2380      | Etcd server client API                               |
| TCP          | Inbound       | 10250-10252    | Kubelet API, kube-scheduler, kube-controller-manager |
| UDP          | Inbound       | 6783-6784      | Weave data ports                                     |
| TCP          | Inbound       | 6783           | Weave control port                                   |
| TCP          | Inbound       | 30000-32767    | NodePort services                                    |
| UDP          | Inbound       | 514            | Swimlane (Syslog receiver)                           |
| TCP          | Inbound       | 8800           | For Replicated deployment - console/dashboard/ui     |
| TCP          | Inbound       | 9870-9881      | For Replicated deployment - internal communication   |

Below is an example of how the above ports are configured using firewalld.

:::BlockQuote
\# Change to root
$ sudo -i

\# Install firewalld if not installed, for example on CentOS
$ yum install firewalld -y
\# Enable and start firewalld
$ systemctl enable firewalld
$ systemctl start firewalld
\# Create a file and add the rules below 
$ vi firewalld-rules.sh

\#!/bin/bash
set -e

echo "net.ipv4.ip\_forward = 1" >> /etc/sysctl.conf
sysctl -p

firewall-cmd --zone=external --add-masquerade

firewall-cmd --permanent --zone=trusted --add-interface=weave

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="22" accept'

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="443" accept'

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="6443" accept'

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="2379-2380" accept'

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="10250-10252" accept'

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="udp" port="6873-6874" accept'

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="6873" accept'

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="32000-32767" accept'

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="udp" port="514" accept'

\# For Replicated deployment
firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="8800" accept'

\# For Replicated deployment
firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  port protocol="tcp" port="9870-9881" accept'

firewall-cmd --reload

\# Set proper permissions
$ chmod 700 firewalld-rules.sh

\# Run the script to add the rules
$ ./firewalld-rules.sh
:::