Skip to content

initial guide on fapolidy and firewalld #8598

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
coltoneshaw wants to merge 2 commits into
base: master
Choose a base branch
from
+300 −33
Open

initial guide on fapolidy and firewalld #8598

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0d85213
initial guide on fapolidy and firewalld
coltoneshaw Dec 19, 2025
0f24709
covert to tabs
coltoneshaw Dec 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions source/administration-guide/configure/calls-deployment.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,26 @@ Mattermost Calls can function in air-gapped environments. Exposing Calls to the
- Configuring a STUN server is unnecessary, as all connections occur within the local network.
- The [ICE Host Override](https://docs.mattermost.com/configure/plugins-configuration-settings.html#ice-host-override) configuration setting can be optionally set with a local IP address (e.g., 192.168.1.45), depending on the specific network configuration and topology.

### RHEL deployments with firewalld and fapolicyd

When deploying Mattermost Calls or the rtcd service on RHEL systems with firewalld or fapolicyd enabled, additional firewall and security configuration is required.

**Required ports:**
- **Calls plugin (integrated)**: Port 8443 UDP/TCP for RTC media traffic
- **rtcd service (standalone)**: Ports 8443 UDP/TCP for RTC media traffic + Port 8045 TCP for API communication with Mattermost

**Configuration steps:**

For complete firewalld and fapolicyd configuration instructions, including troubleshooting steps and example rules, see the [RHEL deployment guide](https://docs.mattermost.com/deploy/server/deploy-rhel.html). The guide includes:
Copy link
Member

@cwarnermm cwarnermm Dec 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's link to the current home of the RHEL deployment guide on GitHub. We can update this link once that content moves over to the Product Docs site.

Copy link
Member Author

@coltoneshaw coltoneshaw Dec 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is linking for the fapolicy stuff that doesn't live on github that's in the rhel docs

Copy link
Member

@cwarnermm cwarnermm Dec 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK. In the generated preview, that URL isn't resolving as expected. This will work: https://docs.mattermost.com/deployment-guide/server/deploy-linux.html#itab--RHEL-CentOS--0_1-RHEL-CentOS

- firewalld port configuration for Mattermost, Calls plugin, and rtcd service
- fapolicyd rules for Mattermost server and Calls plugin
- Separate fapolicyd configuration for standalone rtcd service
- Troubleshooting guidance for "operation not permitted" errors

```{note}
The Calls plugin runs as part of Mattermost and is covered by the standard Mattermost fapolicyd rules. Only the standalone rtcd service requires separate fapolicyd configuration.
```

## Limitations

- All Mattermost customers can start, join, and participate in 1:1 audio calls with optional screen sharing.
Expand Down
Loading