From 81202eb18ddf04d0be30ce36d1a42a51c5bd055e Mon Sep 17 00:00:00 2001 From: schmidt-scaled <82834682+schmidt-scaled@users.noreply.github.com> Date: Mon, 10 Aug 2026 21:44:26 +0200 Subject: [PATCH 1/2] docs: tighten the storage node firewall snippet The port table this snippet includes lists the hosts and the network per service, while the script opens every port on all interfaces. Say so, and name the table columns that carry the sources for a tighter rule set. Drop the duplicated "TCP and UDP" from the second sentence and title the code block by what it does. Co-Authored-By: Claude Opus 5 (1M context) --- snippets/iptables-setup-docker-swarm.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/snippets/iptables-setup-docker-swarm.md b/snippets/iptables-setup-docker-swarm.md index e43d81a5..ed4ba80d 100644 --- a/snippets/iptables-setup-docker-swarm.md +++ b/snippets/iptables-setup-docker-swarm.md @@ -1,14 +1,15 @@ -Simplyblock requires a number of TCP and UDP ports to be opened from certain networks. Following is a list of all -ports (TCP and UDP) required for operation as a storage node. +Simplyblock requires a number of TCP and UDP ports to be reachable from the control and the storage network. The +following table lists every port required for operation as a storage node. !!! note The NVMf port range is used twice. It is TCP for NVMe-oF/TCP and UDP for NVMe-oF/RDMA. {% include 'network-port-table-sn.md' %} -The following script opens those ports with `iptables`. +The following script opens those ports with `iptables`. No source address is enforced by it. Where a tighter rule +set is required, the sources given in the Hosts and the Network column are applied on top. -```bash title="Configuration script for iptables" +```bash title="Opening the storage node ports with iptables" #!/usr/bin/env bash iptables -A INPUT -p icmp -j ACCEPT From 1b1be18283f2cfb6249398da2616830d0bc46fcb Mon Sep 17 00:00:00 2001 From: schmidt-scaled <82834682+schmidt-scaled@users.noreply.github.com> Date: Fri, 21 Aug 2026 20:42:13 +0200 Subject: [PATCH 2/2] docs: mark the NVMf port range as TCP and UDP in the port tables Both port tables listed the NVMf range as TCP only, while the range carries NVMe-oF/TCP over TCP and NVMe-oF/RDMA over UDP. Add the protocol and a table footnote naming the two transports, and drop the admonition in the firewall snippet that carried the same fact for the storage node table alone. Co-Authored-By: Claude Opus 5 (1M context) --- snippets/iptables-setup-docker-swarm.md | 3 --- snippets/network-port-table-sn.md | 19 ++++++++++++------- snippets/network-port-table.md | 23 ++++++++++++++--------- 3 files changed, 26 insertions(+), 19 deletions(-) diff --git a/snippets/iptables-setup-docker-swarm.md b/snippets/iptables-setup-docker-swarm.md index ed4ba80d..3ac3c57b 100644 --- a/snippets/iptables-setup-docker-swarm.md +++ b/snippets/iptables-setup-docker-swarm.md @@ -1,9 +1,6 @@ Simplyblock requires a number of TCP and UDP ports to be reachable from the control and the storage network. The following table lists every port required for operation as a storage node. -!!! note - The NVMf port range is used twice. It is TCP for NVMe-oF/TCP and UDP for NVMe-oF/RDMA. - {% include 'network-port-table-sn.md' %} The following script opens those ports with `iptables`. No source address is enforced by it. Where a tighter rule diff --git a/snippets/network-port-table-sn.md b/snippets/network-port-table-sn.md index e37028a6..ad430e14 100644 --- a/snippets/network-port-table-sn.md +++ b/snippets/network-port-table-sn.md @@ -1,7 +1,12 @@ -| Service | Direction | Hosts | Network | Port(s) | Protocol(s) | -|----------------------|-----------------|------------------|---------|-----------|-------------| -| ICMP | ingress | control | Control | - | ICMP | -| storage-node-api | ingress | control | Control | 5000 | TCP | -| NVMf (client-target) | ingress | client | Storage | 4420-4499 | TCP | -| NVMf (internal) | ingress, egress | storage | Storage | 4420-4499 | TCP | -| storage-node-RPC | ingress | storage, control | Control | 8080-9044 | TCP | +| Service | Direction | Hosts | Network | Port(s) | Protocol(s) | +|----------------------|-----------------|------------------|---------|-----------|-------------------------| +| ICMP | ingress | control | Control | - | ICMP | +| storage-node-api | ingress | control | Control | 5000 | TCP | +| NVMf (client-target) | ingress | client | Storage | 4420-4499 | TCP, UDP (1) | +| NVMf (internal) | ingress, egress | storage | Storage | 4420-4499 | TCP, UDP (1) | +| storage-node-RPC | ingress | storage, control | Control | 8080-9044 | TCP | + + +1 The NVMf port range carries both transports. NVMe-oF/TCP uses it over TCP, NVMe-oF/RDMA +over UDP. Only the protocol of the transport in use has to be opened. + diff --git a/snippets/network-port-table.md b/snippets/network-port-table.md index c7c88a79..8ba0c864 100644 --- a/snippets/network-port-table.md +++ b/snippets/network-port-table.md @@ -1,9 +1,14 @@ -| Service | Direction | Hosts | Network | Port(s) | Protocol(s) | -|----------------------|-----------------|------------------|---------|---------------------------------|-------------| -| ICMP | egress | control | Control | - | ICMP | -| storage-node-api | egress | storage | Control | 5000 | TCP | -| NVMf (client-target) | egress | client | Storage | 4420-4499 | TCP | -| FoundationDB | ingress, egress | control | Control | 4500 | TCP | -| control-plane-API | ingress | control | Control | 80 | TCP | -| storage-node-RPC | ingress, egress | storage, control | Control | 8080-9044 | TCP | -| Monitoring Stack | ingress, egress | control | Control | 12202, 13301, 13302, 9200, 9090 | TCP | +| Service | Direction | Hosts | Network | Port(s) | Protocol(s) | +|----------------------|-----------------|------------------|---------|---------------------------------|-------------------------| +| ICMP | egress | control | Control | - | ICMP | +| storage-node-api | egress | storage | Control | 5000 | TCP | +| NVMf (client-target) | egress | client | Storage | 4420-4499 | TCP, UDP (1) | +| FoundationDB | ingress, egress | control | Control | 4500 | TCP | +| control-plane-API | ingress | control | Control | 80 | TCP | +| storage-node-RPC | ingress, egress | storage, control | Control | 8080-9044 | TCP | +| Monitoring Stack | ingress, egress | control | Control | 12202, 13301, 13302, 9200, 9090 | TCP | + + +1 The NVMf port range carries both transports. NVMe-oF/TCP uses it over TCP, NVMe-oF/RDMA +over UDP. Only the protocol of the transport(s) in use has to be opened. +