Configure a Stateful Firewall for RightLink Compatibility
Overview
The RightLink management agent makes outbound HTTP(S) connections to the RightScale infrastructure in order to receive configuration instructions. Optional RightScale features such as monitoring and frozen package repositories make outbound connections using other protocols.
When RightLink resides behind a firewall that performs egress filtering, the firewall must be configured to allow this outbound traffic.
Prerequisites
This information applies to the following environment:
- Compute instances that use RightLink v6.0 or later
- Network firewalls that perform stateful egress filtering, including:
- AWS VPC Security Groups
- OpenStack (Neutron) Security Groups
- Windows Azure Network Security Groups (NSGs)
This information does not apply to:
- Compute instances that use RightLink v5.x
- Stateless firewalls:
- AWS VPC Network ACLs (NACLs)
- Ingress-only firewalls:
- AWS Classic Security Groups
- GCE Firewalls
- Azure Network ACLs (NACLs)
Screenshots in this document depict the RightScale Network management UI, but the firewall rules and overall procedure can be applied to any egress-filtering firewall through any management interface.
Goal
After completing this how-to, you will have configured your network for compatibility with RightScale-managed compute instances. You will be able to launch Servers and ServerArray instances, see audit entries, see instance state changes and use optional features such as monitoring and NTP synchronization, all without exposing your instances to unwanted network traffic.
Procedure
Note RightScale-Operated Networks
RightScale operates network infrastructure in several geographical regions to provide fault tolerance. Your instances generally communicate with infrastructure in a nearby geographical region, but may be redirected to remote regions during network or cloud outages.
| Network/CIDR | Location | Description |
| 54.225.248.128/27 | US-East | us-3 cluster and island1 resources |
| 54.244.88.96/27 | US-West | us-4 cluster and island10 resources |
| 54.86.63.128/26 | US-East | additional island1 resources |
| 54.187.254.128/26 | US-West | additional island10 resources |
|
54.217.243.218/32 54.217.243.226/32 | Europe | island2 resources. Can be removed after April 30, 2015. Only required for workloads in AWS EU-Frankfurt and AWS EU-Ireland. |
| 54.246.247.16/28 | Europe | Only required for workloads in AWS EU-West and EU-Central. |
| 54.248.220.136/32 54.248.220.137/32 | Japan | island8 resources. Can be removed after April 30 2015. Only required for workloads in AWS AP-Tokyo and AWS AP-Sydney |
| 54.248.220.128/28 | Japan | Only required for workloads in AWS AP-Tokyo and AWS AP-Sydney. |
| 54.251.98.164/32 54.251.106.120/32 | Singapore | island5 resources. Can be removed after April 30 2015. Only required for workloads in AWS AP-Singapore. |
| 54.255.255.208/28 | Singapore | Only required for workloads in AWS AP-Singapore. |
Enable RightLink Communication
RightLink communicates with the RightScale infrastructure using HTTPS (tcp/443) and HTTP (tcp/80). Your firewall should allow instances to make outbound connections to RightScale infrastructure using these protocols. For example:
Optional: Enable Time Synchronization
Good time synchronization is important in networking, and particularly important in the cloud because virtualization environments can introduce clock drift. RightLink uses OS facilities to perform NTP sync, first attempting to use OS defaults and then attempting to synchronize with RightScale-operated NTP servers.
If your base images have functional default NTP settings, or if you wish to skip NTP synchronization, no firewall changes are required. Otherwise, your firewall should allow instances to use RightScale's NTP servers. For example:
See our NTP documentation for more information about NTP settings and defaults.
Optional: Enable RightScale Monitoring
| NOTE: this step will no longer be necessary once RightScale deploys its next-generation monitoring infrastructure in 2015Q1. |
RightScale optionally utilizes the collectd protocol (udp/3011) to collect monitoring metrics from your instances and raise user-defined alerts. If you wish to use RightScale monitoring, your firewall should allow instances to send UDP packets to RightScale's servers on this port. For example:
What's Next
Your firewall has been configured for compatibility with RightLink. If your networking environment includes a stateless firewall in addition to a stateful firewall (e.g. AWS VPC Network ACLs) then you should ensure that your stateless firewall is properly configured. You may also wish to boot some test instances to ensure that everything is working well.
To learn more about the firewall functionality of your cloud, refer to the following external links:
- © Copyright 2015 RightScale Technical Support