Experimental Physics and
Industrial Control System

IMO it would be prudent to recommend that a machine hosting soft-iocs
should also open incoming traffic on the repeater port since it is
possible that soft-iocs contain CA links and therefore are clients, too.
(And the network administrator normally doesn't know about the IOC
internals.)

Thanks to input from Jeff Hill, Ralph Lange, and Andrew Johnson I think that the following is an accurate description of the firewall settings needed to support channel access.

====================================================================
If you want channel access clients on a machine to be able to see beacons and replies to broadcast PV search requests you need to permit inbound UDP packets with source port EPICS_CA_SERVER_PORT (default is 5064) or destination port EPICS_CA_REPEATER_PORT (default is 5065).  On systems using iptables this can be accomplished by rules like
	-A INPUT -s 192.168.0.0/22 -p udp --sport 5064 -j ACCEPT
	-A INPUT -s 192.168.0.0/22 -p udp --dport 5065 -j ACCEPT

If you want channel access servers (e.g. "soft IOCs") on a machine to be able to see clients you need to permit inbound TCP or UDP packets with source port EPICS_CA_SERVER_PORT (default is 5064).  On systems using iptables this can be accomplished by rules like
	-A INPUT -s 192.168.0.0/22 -p udp --dport 5064 -j ACCEPT
	-A INPUT -s 192.168.0.0/22 -p tcp --dport 5064 -j ACCEPT

The above sets of rules are complete assuming that there's no blocking of outbound traffic.

In all cases the "-s 192.168.0.0/22" specifies the range of addresses from which you wish to accept packets.
====================================================================

Replies:

Re: Firewall (iptables) issues? Eric Norum

References:

Firewall (iptables) issues? Eric Norum

Re: Firewall (iptables) issues? Ralph Lange

Re: Firewall (iptables) issues? Eric Norum

Navigate by Date:

Prev: RE: Firewall (iptables) issues? Jeff Hill

Next: Re: Firewall (iptables) issues? Eric Norum

Index: 1994  1995  1996  1997  1998  1999  2000  2001  2002  2003  2004  2005  2006  2007  2008  2009  <2010>  2011  2012  2013  2014  2015  2016  2017  2018  2019  2020  2021  2022  2023  2024 

Navigate by Thread:

Prev: Re: Firewall (iptables) issues? Eric Norum

Next: Re: Firewall (iptables) issues? Eric Norum

Index: 1994  1995  1996  1997  1998  1999  2000  2001  2002  2003  2004  2005  2006  2007  2008  2009  <2010>  2011  2012  2013  2014  2015  2016  2017  2018  2019  2020  2021  2022  2023  2024