Corosync+Pacemaker under iptables and selinux

2.12. Configuring the iptables Firewall to Allow Cluster Components

You can use the following filtering to allow traffic through the iptables firewall for the various cluster components.

Forcorosync, use the following filtering. Port 5405 is used to receive multicast traffic.

iptables -I INPUT -p udp -m state --state NEW -m multiport --dports 5404,5405 -j ACCEPT

Forricci:

iptables -I INPUT -p tcp -m state --state NEW -m multiport --dports 11111 -j ACCEPT

Formodcluster:

iptables -I INPUT -p tcp -m state --state NEW -m multiport --dports 16851 -j ACCEPT

Forluci:

iptables -I INPUT -p tcp -m state --state NEW -m multiport --dports 8084 -j ACCEPT

ForDLM:

iptables -I INPUT -p tcp -m state --state NEW -m multiport --dports 21064 -j ACCEPT

After executing these commands, run the following command.

service iptables save ; service iptables restart

In Red Hat Enterprise Linux 6, rgmanager does not access the network directly; rgmanager communication happens by means of corosync network transport. Enabling corosync allows rgmanager (or any corosync clients) to work automatically.

corosync+pacemaker under iptables and selinux

=================================================

-A INPUT -p igmp -j ACCEPT

-A INPUT -m addrtype –dst-type MULTICAST -j ACCEPT

-A INPUT -p udp -m state –state NEW -m multiport –dports 5404,5405 -j ACCEPT

mcastport: 5405

SElinux policy module:

module corosync 1.1;

require {

type corosync_t;

type sysctl_kernel_t;

type lib_t;

class dir search;

class file { read execute_no_trans };

}

#============= corosync_t ==============

allow corosync_t lib_t:file execute_no_trans;

allow corosync_t sysctl_kernel_t:dir search;

allow corosync_t sysctl_kernel_t:file read;

P.S. sealert -a /var/log/audit/audit.log

-----------------------------------------------------------------------

You just need to know the ports to open. Here is the list of ones I know of:

Port   Protocol   Component

5404, 5405 UDP cman

8084, 5405 TCP luci

11111 TCP ricci

14567 TCP gnbd

16851 TCP modclusterd

21064 TCP dlm

50006, 50008, 50009 TCP ccsd

50007 UDP ccsd

Note that this is from a RHCS2 (openais) perspective. I may be missing pacemaker-specific ones.

You need to make sure these ports are open.