
Firewalls
#########

There may be various firewalls in between the JetStream server and clients. Exceptions or other rules may need to be added to the firewalls protecting the server to allow clients to connect. Typically this means opening and possibly forwarding port ``8886`` (both TCP and UDP). See :doc:`/getting_started/requirements` for a list of ports potentially used by the server.


OS Firewalls
============

The OS on the machine hosting the JetStream may be running a software firewall. The following are the most common default firewalls.


Rocky Linux
-----------

By default, the Rocky firewall :program:`firewalld` is enabled. To allow connection to the JetStream server, you will need to configure or disable the firewall. For instance:

* Allow port 8886 through the firewall:
   .. code-block:: shell-session

      # sudo firewall-cmd --permanent --zone=public --add-port=8886/tcp --add-port=8886/udp
      # sudo systemctl restart firewalld

* Disable the firewall:
   .. code-block:: shell-session

      # sudo systemctl stop firewalld
      # sudo systemctl disable firewalld

.. note::
   Additional UDP ports for may be opened for concurrent transfers. See :ref:`network_firewall`.


Ubuntu
------

By default, the Ubuntu firewall :program:`ufw` is disabled. If you choose to enable it, then you will need to configure it to allow connections to the JetStream server. For instance:

.. code-block:: shell-session

    # sudo ufw allow 8886


macOS
-----

By default, the macOS firewall is disabled. It can be configured by navigating to :menuselection:`System Preferences --> Security \& Privacy --> Firewall`. When enabled, the default setting :guilabel:`Automatically allow downloaded signed software to receive incoming connections` should allow connections to the JetStream server. If this option is off, or JetStream is blocked for any reason, then an exception can be added by selecting :program:`jetstream` from the presented list:

.. image:: /media/images/configuration/firewall-macos.png


.. _external_firewalls:

External Firewalls
==================

To allow clients to connect to the JetStream server from an external network, any external firewalls between the server and the internet will need to be configured. Typical configuration tasks include:

* **Port Forwarding**: Allow ports ``8886/tcp`` and ``8886/udp`` to be redirected to the JetStream server.
* **Allow Licensing**: The server needs to make an outgoing to ``licensing.gojetstream.io`` on port ``8885/TCP``. If outgoing connections are restricted, a rule should be added to allow the server to contact the license server.
* **Check QoS Settings**: Some firewalls restrict or deprioritize UDP traffic which can reduce transfer performance. If the connection is slower than expected, you may need to adjust your QoS settings.

Firewalls have various security policies that may sometimes interfere with normal server operations. These include:

* **Deep Packet Inspection**: Some enterprise firewalls provide "Deep Packet Inspection" or "Layer 7 Scanning" options that can block JetStream traffic. These systems can miscategorize JetStream network traffic and therefore block it, sometimes after many hours of operation. In these cases, add an exception according to the firewall documentation.
* **SSL Inspection**: Some enterprise firewalls provice "SSL Inspection". When enabled, the firewall replaces SSL certificates with their own, allowing them to analyze encrypted network traffic. This feature can prevent a JetStream server from successfully connecting to the license server at ``licensing.gojetstream.io``, resulting in a licensing error such as "Failed to load license server certificate." The firewall settings need to be adjusted to resolve this issue.
