1

While using ufw (Uncomplicated FireWall) and I noticed that the local juju machines were stuck in a pending state.

$ juju status
environment: local
machines:
  "0":
    agent-state: started
    agent-version: 1.20.14.1
    dns-name: localhost
    instance-id: localhost
    series: trusty
    state-server-member-status: has-vote
  "1":
    agent-state: pending
    instance-id: mbruzek-local-machine-1
    series: precise
    hardware: arch=amd64
services:
  ubuntu:
    charm: cs:precise/ubuntu-4
    exposed: false
    units:
      ubuntu/0:
        agent-state: pending
        machine: "1"

The Juju LXC documentation warns:

If you are running a firewall such as ufw, it may interfere with the correct operation of Juju using LXC containers and might need to be halted.

After disabling ufw I was able to deploy the ubuntu charm without a problem.

I want to be able to continue to use my firewall and use Juju. How do I use Juju local with a firewall?

1

After some experimentation I was able to find the minimum required ports to resolve the agent-state: pending problem.

Juju uses port 22 (ssh), juju state server uses port 17070, jujud uses port 8040. I am told this may not work with Juju set up in an HA mode because that uses different ports.

Allowing these ports in ufw:

$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
17070                      ALLOW       Anywhere
8040                       ALLOW       Anywhere
22/tcp (v6)                ALLOW       Anywhere (v6)
17070 (v6)                 ALLOW       Anywhere (v6)
8040 (v6)                  ALLOW       Anywhere (v6)

I was able to deploy with this ufw configuration. If anyone knows of other ports that should be enabled please post them here.

1

As of Juju 2.0 beta3 I needed:

To                         Action      From
--                         ------      ----
17070/tcp                  ALLOW       Anywhere                  
22/tcp                     ALLOW       Anywhere                  
8443/tcp                   ALLOW       Anywhere                  
443/tcp                    ALLOW       Anywhere                  
80/tcp                     ALLOW       Anywhere                             
17070/tcp (v6)             ALLOW       Anywhere (v6)             
22/tcp (v6)                ALLOW       Anywhere (v6)             
8443/tcp (v6)              ALLOW       Anywhere (v6)             
443/tcp (v6)               ALLOW       Anywhere (v6)             
80/tcp (v6)                ALLOW       Anywhere (v6)  

I likely didn't need 80 or 443, but had them enabled anyhow. So I left them in. It appears 8040 is now 8443 and that you only need it to allow tcp.

  • Thx!!! Allowing 8443 did the trick for me. – user12164 Apr 5 '18 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.