Guidelines for Implementing IP Table Rules in UiPath Automation Suite on Linux

News Knowledge Base
1

What are the guidelines for implementing IP Table Rules in UiPath Automation Suite on Linux?

Issue description:

Customers may request to implement custom IP Table rules in their Linux environment running UiPath Automation Suite for traffic control and network isolation.

However, modifying IP Table rules is not supported or recommended by UiPath. Unmanaged changes may cause communication breakdowns between nodes, pods, or external services, leading to deployment failure, node unreachability, or unexpected automation runtime behaviour.

Cause:

UiPath Automation Suite relies on default Kubernetes networking and Cilium interfaces to manage traffic between cluster nodes and pods. Direct manipulation of the host-level firewall using iptables can conflict with Cilium’s traffic policies and cause disruptions.

  • Changes made by customers to iptables may override or conflict with Cilium configurations.
  • Certain traffic like DNS, internal node communication, or load balancer ingress may get blocked if not correctly allowed.
  • This is outside the scope of UiPath’s support, and misconfiguration can lead to serious issues.

Resolution:

Important: UiPath does not maintain or support the following rule set. It is provided as-is to support customers with non-negotiable security requirements. Responsibility for implementation and maintenance lies solely with the customer.

If customers must apply iptables rules, the following sample can be shared with their network/security team:

Sample IP Table Rule Set:

# Define environment CIDRs

NODE_CIDR=10.0.1.0/24


POD_CIDR="10.42.0.0/16" # Modify if using a different pod CIDR


Allow loopback traffic


iptables -A INPUT -i lo -j ACCEPT


iptables -A OUTPUT -o lo -j ACCEPT


Allow established connections


iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT


iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT


Allow traffic on Cilium interfaces


iptables -A INPUT -i cilium_host -j ACCEPT


iptables -A OUTPUT -o cilium_host -j ACCEPT


iptables -A FORWARD -i cilium_host -j ACCEPT


iptables -A FORWARD -o cilium_host -j ACCEPT


iptables -A INPUT -i cilium_vxlan -j ACCEPT


iptables -A OUTPUT -o cilium_vxlan -j ACCEPT


iptables -A FORWARD -i cilium_vxlan -j ACCEPT


iptables -A FORWARD -o cilium_vxlan -j ACCEPT


Allow intra-node communication


iptables -A INPUT -p tcp -m multiport -s "$NODE_CIDR" --dports 2379,2380,4240,10250,30071 -j ACCEPT


iptables -A OUTPUT -p tcp -m multiport -d "$NODE_CIDR" --dports 2379,2380,4240,10250,30071 -j ACCEPT


iptables -A INPUT -p icmp -s "$NODE_CIDR" -j ACCEPT


iptables -A OUTPUT -p icmp -d "$NODE_CIDR" -j ACCEPT


iptables -A INPUT -p udp -s "$NODE_CIDR" --dport 8472 -j ACCEPT


iptables -A OUTPUT -p udp -d "$NODE_CIDR" --dport 8472 -j ACCEPT


Allow Pod CIDR traffic


iptables -A INPUT -s "$POD_CIDR" -j ACCEPT


iptables -A INPUT -d "$POD_CIDR" -j ACCEPT


iptables -A OUTPUT -d "$POD_CIDR" -j ACCEPT


iptables -A FORWARD -s "$POD_CIDR" -j ACCEPT


iptables -A FORWARD -d "$POD_CIDR" -j ACCEPT


Allow listener ports (e.g., SSH, HTTPS, UI)


iptables -A INPUT -p tcp -m multiport --dports 22,80,443,6443,9345,30070 -j ACCEPT


iptables -A OUTPUT -p tcp -m multiport --dports 22,80,443,6443,9345,30070 -j ACCEPT


Allow DNS traffic


iptables -A OUTPUT -p udp --dport 53 -j ACCEPT


iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT


iptables -A INPUT -p udp --sport 53 -j ACCEPT


iptables -A INPUT -p tcp --sport 53 -j ACCEPT


Set default policy to DROP (enforces whitelist-only behavior)


iptables -P INPUT DROP


iptables -P OUTPUT DROP


iptables -P FORWARD DROP

Additional Notes:

  • This rule set assumes the use of Cilium as the CNI (Container Network Interface).
  • Always test in a non-production environment before applying rules cluster-wide.
  • This setup should be maintained and updated by the customer’s network administrator or DevOps team.
  • UiPath does not troubleshoot issues arising from custom firewall or IP table configurations.