Product SiteDocumentation Site

2.2.3. Examples of iptables Rules

This section provides iptables rule examples for enabling IP ports on Red Hat Cluster nodes and computers that run luci. The examples enable IP ports for a computer having an IP address of 10.10.10.200, using a subnet mask of 10.10.10.0/24.

Note

Examples are for cluster nodes unless otherwise noted in the example titles.

Note

Both rules in Example 2.1, “Port 5404, 5405: cman” are required.
The first rule in this example is for use with a multicast address generated by cman. If you specify a multicast address manually, make the rule using the multicast address that you specify instead of the cman-generated multicast address. For more information about configuring a multicast address, refer to Section 3.4, “Global Cluster Properties” or Section 5.2, “Starting the Cluster Configuration Tool”. 
iptables -A INPUT -s 10.10.10.0/24 -d 239.192.0.0/16 -p udp -m state --state NEW -m multiport --dports 5404,5405 -j ACCEPT

iptables -A INPUT -s 10.10.10.0/24 -d 10.10.10.0/24 -p udp -m state --state NEW -m multiport --dports 5404,5405 -j ACCEPT
Example 2.1. Port 5404, 5405: cman

-A INPUT -i 10.10.10.200 -m state --state NEW -m multiport -p tcp -s 10.10.10.0/24 -d 10.10.10.0/24 --dports 8084 -j ACCEPT
Example 2.2. Port 8084: luci (Cluster Node or Computer Running luci)

-A INPUT -i 10.10.10.200 -m state --state NEW -m multiport -p tcp -s 10.10.10.0/24 -d 10.10.10.0/24 --dports 11111 -j ACCEPT
Example 2.3. Port 11111: ricci (Cluster Node and Computer Running luci)

-A INPUT -i 10.10.10.200 -m state --state NEW -m multiport -p tcp -s 10.10.10.0/24 -d 10.10.10.0/24 --dports 14567 -j ACCEPT
Example 2.4. Port 14567: gnbd

-A INPUT -i 10.10.10.200 -m state --state NEW -m multiport -p tcp -s 10.10.10.0/24 -d 10.10.10.0/24 --dports 16851 -j ACCEPT
Example 2.5. Port 16851: modclusterd

-A INPUT -i 10.10.10.200 -m state --state NEW -m multiport -p tcp -s 10.10.10.0/24 -d 10.10.10.0/24 --dports 21064 -j ACCEPT
Example 2.6. Port 21064: dlm

-A INPUT -i 10.10.10.200 -m state --state NEW -m multiport -p tcp -s 10.10.10.0/24 -d 10.10.10.0/24 --dports 41966,41967,41968,41969 -j ACCEPT
Example 2.7. Ports 41966, 41967, 41968, 41969: rgmanager

-A INPUT -i 10.10.10.200 -m state --state NEW -m multiport -p tcp -s 10.10.10.0/24 -d 10.10.10.0/24 --dports 50006,50008,50009 -j ACCEPT
Example 2.8. Ports 50006, 50008, 50009: ccsd (TCP)

-A INPUT -i 10.10.10.200 -m state --state NEW -m multiport -p udp -s 10.10.10.0/24 -d 10.10.10.0/24 --dports 50007 -j ACCEPT
Example 2.9. Port 50007: ccsd (UDP)