Firewall recommendations for IBM Storage Scale GUI

Dedicating certain ports for firewalls helps to secure the IBM Storage Scale management GUI.

The following table lists the ports that need to be used to secure GUI.

Table 1. Firewall recommendations for GUI
Port Number	Protocol	Service Name
47080	TCP, localhost only	Management GUI
47443	TCP, localhost only	Management GUI
80	TCP	Management GUI IBM Storage Scale management API
443	TCP	Management GUI IBM Storage Scale management API
4444	TCP, localhost only	Management GUI
9980	TCP	Performance monitoring tool When using IBM Storage Scale System or IBM Storage Scale Software
9981	TCP	Performance monitoring tool This port is required only if IBM Storage Scale Container Native Storage is used

All nodes of the IBM Storage Scale cluster must be able to communicate with the GUI nodes through the ports 80 and 443. If multiple GUI nodes are available in a cluster, the communication among those GUI nodes is carried out through the port 443.

Both the management GUI and IBM Storage Scale management API share the same ports. That is, 80 and 443. However, for APIs, the ports 443 and 80 are internally forwarded to 47443 and 47080 respectively. This is done automatically by an iptables rule that is added during the startup of the GUI and is removed when the GUI is being stopped. The update mechanism for iptables can be disabled by setting the variable UPDATE_IPTABLES to false, which is stored at: /etc/sysconfig/gpfsgui.

Note: The GUI cannot coexist with a web server that uses the same ports. You can change the GUI ports to avoid any conflicts. For more information, see IBM Storage Scale GUI port usage.

If you are installing GUI on RHEL 9 then you must install nftables.

The management GUI uses ZIMon to collect performance data. ZIMon collectors are normally deployed with the management GUI and sometimes on other systems in a federated configuration. Each ZIMon collector uses three ports, which can be configured in ZIMonCollector.cfg. The default ports are 4739, 9980, and 9981. The GUI is sending its queries on the ports 9980, and 9981 and these ports are accessible only from the localhost. For more information on the ports used by the performance monitoring tools, see Firewall recommendations for Performance Monitoring tool.

The port 4444 is accessible only from the localhost.