Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hi I am trying to use puppet client/master to set up my servers. I have everything working perfectly on local VM's and now I'm trying to set up my first external server. However I can't get the client on the external server to connect to the master; probably because the master is behind a firewall with only port 22 open. I started looking into SSH tunnels but I can't seem to get it working. Does anyone have any experience with this?

share|improve this question
And you can't open port 8140? – Michael Hampton Nov 2 '12 at 18:29
up vote 5 down vote accepted

Your best bet is to file a ticket requesting the following firewall rule be enabled:

PuppetClients -> PuppetMaster 8140/tcp

The Client<->Master communication is already encrypted over an SSL tunnel. In order to have it go over ssh will require some configuration hackery on both clients and server that will only serve to confuse and confound anyone else that works on your environment. You're better off having off opening the firewall.

share|improve this answer

I wouldn't discount what Scott Pack says, but the hackery isn't that big a deal for one-shot type use, and sometimes this is useful for deployment. ssh is less acceptable for a persistent tunnel, and in any case for ongoing maintenance via puppet, see Scott's answer and do it properly.

You can trigger puppet from the puppetmaster like so:

ssh -R 8140:localhost:8140 puppet agent --test --server puppet

You can use any server name that matches up with the puppetmaster's certificate, and you map that name to localhost in the client's /etc/hosts file.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.