From 3398950f9d3786ed7a2fd4137829593af36c0c97 Mon Sep 17 00:00:00 2001 From: Ralph Lange Date: Fri, 5 Nov 2010 15:41:39 -0400 Subject: [PATCH] ca: Added chapter about firewalls to CA Reference Manual --- src/ca/CAref.html | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/src/ca/CAref.html b/src/ca/CAref.html index 75bccadfd..c26af5000 100644 --- a/src/ca/CAref.html +++ b/src/ca/CAref.html @@ -64,6 +64,7 @@ $Date$

  • IP Network Administration Background Information
  • IP port numbers
    • +
  • Firewalls
  • WAN Environment
  • Disconnect Time Out Interval / Server Beacon Period
    • @@ -451,6 +452,32 @@ different port numbers then an extended syntax may be used with the EPICS_CA_ADDR_LIST environment variable. See WAN Environment below.

    +

    Firewalls

    + +

    If you want channel access clients on a machine to be able to see +beacons and replies to broadcast PV search requests you need to permit +inbound UDP packets with source port EPICS_CA_SERVER_PORT (default is 5064) +or destination port EPICS_CA_REPEATER_PORT (default is 5065). On systems +using iptables this can be accomplished by a rule like

    + +
    +     -A INPUT -s 192.168.0.0/22 -p udp --sport 5064 -j ACCEPT
+     -A INPUT -s 192.168.0.0/22 -p udp --dport 5065 -j ACCEPT
+
    + +

    If you want channel access servers (e.g. "soft IOCs") on a machine to be +able to see clients you need to permit inbound TCP or UDP packets with source +port EPICS_CA_SERVER_PORT (default is 5064). On systems using iptables this +can be accomplished by rules like

    + +
    +     -A INPUT -s 192.168.0.0/22 -p udp --dport 5064 -j ACCEPT
+     -A INPUT -s 192.168.0.0/22 -p tcp --dport 5064 -j ACCEPT
+
    + +

    In all cases the "-s 192.168.0.0/22" specifies the range of addresses from +which you wish to accept packets.

    +

    WAN Environment

    When the CA client library connects a channel it must first determine the IP