Enabling or disabling the firewall

You can enable firewall in an IBM Storage Scale System environment for management server, I/O server nodes, and protocol nodes by using the firewall subcommand of the essrun command.

Before you enable the firewall on the system, you must identify and validate all required network ports by referring to the Firewall ports section that lists component-to-component port requirements.

Important: Check the firewall configuration by using the decoupled precheck tool available at Scale System Precheck Tool.
Ensure that you have downloaded the container image from Fix Central. If you have not downloaded the image, download the from Fix Central. For more information, see Preparing a Utility Node.

By default, any node in an IBM Storage Scale System cluster has firewall that is disabled. You can run the firewall subcommand of the essrun command. This command can be run after the deployment of management server node or I/O server nodes is complete.

To access the container, run the following command:
```
cd /home/deploy/<extracted .dir>
```
- If the container is running, connect to the container by running the following command:
```
./essmkyml --reconnect
```
- If the container is not running, restart the container by running the following:
```
./essmkyml --restart
```
Enable the firewall on IBM Storage Scale System nodes.
1. To enable the firewall on required nodes, run the following command:
```
essrun -N <ems1,io1,io2,proto1,...> firewall enable
```
  where:
  
  ems1
  
  Specifies a management node.
  
  io1,io2
  
  Specify I/O nodes.
  
  proto1,...
  
  Specifies protocol nodes.
2. After the firewall is enabled on the management node, exit and restart the container.
```
exit
cd /home/deploy/<extracted .dir>
./essmkyml --restart
```
  If the following message is displayed, type no.
```
[INFO] You may want to wipe it out if EMS IP changed or there are wrong entries in the Inventory --
Inventory file exists, do you want to wipe it out? (y/n):
```
3. To check the firewall status on all nodes, run the following command:
```
essrun -N <ems1,io1,io2,proto1,...> firewall status
```
  The system shows the following firewall status:
```
running
```
4. To check the open ports on specified nodes, run the following command:
```
essrun -N <ems1,io1,io2,proto1,...> firewall list
```
Add firewall ports to nodes.
1. To add one or more ports to the firewall, run the firewall-cmd command with the --permanent and --add-port options.
  - To add a single port, run the following command:
```
firewall-cmd --permanent --add-port=<port>/tcp
```
    If the specified protocol is UDP, use UDP instead of TCP.
  - To add multiple ports, run the following command:
    firewall-cmd --permanent --add-port=<port1>/tcp --add-port=<port2>/tcp --add-port=<port3>/tcp
2. To reload the firewall configuration to apply the changes, run the following command:
```
firewall-cmd --reload
```
To remove one or more ports from the firewall, use the firewall-cmd command with the --permanent and --remove-port options.
- To remove a single port, run the following command:
```
firewall-cmd --permanent --remove-port=<port>/tcp
```
  If the specified protocol is UDP, use UDP instead of TCP.
- To remove multiple ports with a single command, run the following command:
```
firewall-cmd --permanent --remove-port=<port1>/tcp --remove-port=<port2>/tcp --remove-port=<port3>/tcp
```
To disable the firewall on nodes, complete the following steps:
- To disable firewall on the management server node, run the firewall subcommand with the disable option.
```
essrun -N ems1 firewall disable
```
- To disable firewall on I/O server nodes, run the firewall subcommand with the disable option.
```
essrun -N nodeList firewall disable
```