A few weeks ago we had a requirement to restrict the outbounds ports of HDinsight for security reasons, so this article is dedicated to that requirement. Before we begin Microsoft official position on this is:
Important: HDInsight doesn’t support restricting outbound traffic, only inbound traffic. When defining Network Security Group rules for the subnet that contains HDInsight, only use inbound rules.
So after reading the above (from: https://azure.microsoft.com/en-gb/documentation/articles/hdinsight-extend-hadoop-virtual-network/) we took it as a challenge to get this working, after much testing we managed to get all the required ports. We have tried by deploying multiple clusters and so far it all works and deploys correctly, a couple of notes:
- The solution below is not 100% secure but it mitigates the risk by lowering the “attack” service to only the regional azure IPs.
- We also needed to open port 80 to the Ubuntu website (91.189.88.0/21) as this is required by some of the Apache tests after deployment
- While testing we noticed that the servers communicate with the management point over a random port, this port seemed to be in the same range as the dynamic Azure SQL ports of 11000-11999 and 14000-14999. However to be on the safe side we opened a larger range 10000-49151 as we can’t be 100% sure.
- You will need to open multiple rules for each Azure Regional IP (i suggest you combine the ips to the second octed). The ip addresses can be found here: https://www.microsoft.com/en-gb/download/details.aspx?id=41653. You will also need to keep the ip addresses updated (A new xml file will be uploaded every Wednesday (Pacific Time) with the new planned IP address ranges. New IP address ranges will be effective on the following Monday (Pacific Time)).
- This is all unofficial and while we have had no problems with multiple deployments i can’t give any guarantees.
Inbound Ports
| Name | Priority | Action | Source | Source Port | Destination | Destination Port | Protocol | Direction | Description |
|---|---|---|---|---|---|---|---|---|---|
| Allow-HDinsight01-Inbound | 1001 | Allow | 168.61.49.99/32 | * | Subnet Range | 443 | * | Inbound | Required for Hdinsight Healthchecks |
| Allow-HDinsight02-Inbound | 1002 | Allow | 23.99.5.239/32 | * | Subnet Range | 443 | * | Inbound | Required for Hdinsight Healthchecks |
| Allow-HDinsight03-Inbound | 1003 | Allow | 168.61.48.131/32 | * | Subnet Range | 443 | * | Inbound | Required for Hdinsight Healthchecks |
| Allow-HDinsight04-Inbound | 1004 | Allow | 138.91.141.162/32 | * | Subnet Range | 443 | * | Inbound | Required for Hdinsight Healthchecks |
Outbound Ports
| Name | Priority | Action | Source | Source Port | Destination | Destination Port | Protocol | Direction | Description |
|---|---|---|---|---|---|---|---|---|---|
| Allow-HDInsightToUbuntu-Outbound | 2001 | Allow | Subnet Range | * | 91.189.88.0/21 | 80 | TCP | Outbound | Required for Hdinsight |
| Allow-HDinsight01-Outbound | 2002 | Allow | Subnet Range | * | Azure Regional Range | 80 | TCP | Outbound | Required for Hdinsight |
| Allow-HDinsight02-Outbound | 2003 | Allow | Subnet Range | * | Azure Regional Range | 443 | TCP | Outbound | Required for Hdinsight |
| Allow-HDinsight03-Outbound | 2004 | Allow | Subnet Range | * | Azure Regional Range | 1433 | TCP | Outbound | Required for Hdinsight |
| Allow-HDinsight04-Outbound | 2005 | Allow | Subnet Range | * | Azure Regional Range | 10000-49151 | TCP | Outbound | Required for Hdinsight |