...

• an external firewall,
• the operating system firewall of the instance (see Installing the VE License Server and the Charon -SSP Emulator Packages),
• security list of the subnet to which the instance belongs, and
• VNIC-specific Network Security Groups.

...

Please see the relevant Oracle documentation for more information and configuration detail.

Please note: Traffic is allowed if any rule in any of the relevant lists and groups allows the traffic. Traffic is also allowed if it  is the response traffic of a permitted tracked connection. In addition to allowing SSH access, at least TCP port 8083 must be allowed to enable a license client to access a VE license server. If the web interface is to be used, TCP port 8084 must also be allowed.

...

• Each rule is either for incoming or outgoing traffic. It can allow or deny traffic.
• Only IPv4 traffic is supported.
• Firewall rules are stateful (return traffic for an established connection is allowed).
• If TCP traffic is fragmented, a rule is only applied to the first fragment of a packet.

IBM Firewall Information

Access to an IBM cloud instance can be controlled by 

• an external firewall,
• the operating system firewall of the instance,
• IBM-specific security groups, and
• IBM-specific subnet ACLs.

In addition to allowing SSH access, the different firewall levels must be configured to permit at least TCP port 8083 to enable a license client to access a VE license server. If the web interface is to be used, TCP port 8084 must also be allowed.

IBM Cloud Security Groups

Security Groups are associated with a virtual server instance. They have the following characteristics:

• Stateful: once an inbound connection is permitted, return traffic is allowed.
• Only allow rules are possible.
• All rules are considered to determine if traffic should be permitted.
• An instance can have several security groups.

IBM Cloud Subnet ACLs

Subnet ACLs are associated with subnets in a VPC. They have the following characteristics:

• Stateless: inbound and outbound connections must be explicitly allowed.
• Allow and deny rules are possible.
• Rules are processed in sequence.
• One ACL can be assigned to several subnets.
• The default ACL allows all traffic.