iptables + ldirectord

Hello,

I'm trying to configure heartbeat + ldirectord + iptables. All works
fine with only NAT iptables rule, but when I try to change policy to
DROP and set the iptables rules for permiting traffic from and to
heartbeat and from and to the services defined in ldirectord.cf.

Here is the heartbeat and iptables config:

[root@bal1 root]# cat /etc/ha.d/ldirectord.cf
checktimeout=3D60
checkinterval=3D10
autoreload=3Dyes
logfile=3D"/var/log/ldirectord.log"
quiescent=3Dyes

# Balanceo SSH
virtual=3D192.168.1.186:60000
        real=3D10.100.0.11:22 masq 100
        real=3D10.100.0.14:22 masq 100
        scheduler=3Drr
        checktype=3Dconnect
        protocol=3Dtcp
        checktimeout=3D60

[root@bal1 root]# cat /etc/ha.d/haresources
bal1	IPaddr2::192.168.1.186/24/eth0/192.168.1.255 \
	IPaddr2::10.100.0.1/24/eth1/10.100.0.255 \
	ldirectord::/etc/ha.d/ldirectord.cf \
	iptables \
	LVSSyncDaemonSwap::master::eth1



IPTABLES RULES

#!/bin/sh
## Habilito IP FORWARDING
echo 1 > /proc/sys/net/ipv4/ip_forward
## Variables
DEFAULT_POLICY=3D"DROP"
MULTICAST_IP=3D"225.0.0.1"		# multicast IP
IFACE1=3D"eth0"			# NIC WAN
IFACE2=3D"eth1"			# NIC LAN
IP_BAL1=3D"192.168.1.184"			# load balancer 1
IP_BAL2=3D"192.168.1.185"			# load balancer 2
IP_VIP=3D"192.168.1.186"			# VIP
MCAST_IFACE_IP1=3D"10.100.0.11"		# LAN host 1
MCAST_IFACE_IP2=3D"10.100.0.14"		# LAN host 2
MCAST_PORT1=3D"694"			# mcast port 1
SSH_PORT_EXT=3D"60000"			# SSH port externo
SSH_PORT_IN=3D"22"			# SSH port interno
echo -n Aplicando Reglas de Firewall...
## FLUSH de reglas
iptables -F
iptables -X
iptables -Z
iptables -t nat -F
## Politicas por defecto
iptables -P INPUT $DEFAULT_POLICY
iptables -P OUTPUT $DEFAULT_POLICY
iptables -P FORWARD $DEFAULT_POLICY
# iptables -t nat -P PREROUTING $DEFAULT_POLICY
# iptables -t nat -P POSTROUTING $DEFAULT_POLICY
# Permite el trafico por el loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Permito conexiones SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --sport 22 -j ACCEPT
# Dejo pasar los paquetes ICMP
iptables -A INPUT -i eth0 -p ICMP -j ACCEPT
iptables -A OUTPUT -o eth0 -p ICMP -j ACCEPT
iptables -A INPUT -i eth1 -p ICMP -j ACCEPT
iptables -A OUTPUT -o eth1 -p ICMP -j ACCEPT
## NAT
iptables -t nat -A POSTROUTING -p tcp -j SNAT --to-source $IP_VIP
# Multicast uses UDP.
iptables -A INPUT -d $MULTICAST_IP -j ACCEPT
iptables -A INPUT -p udp -m udp --dport $MCAST_PORT1 -j ACCEPT
iptables -A OUTPUT -p udp -d $MULTICAST_IP -s $IP_BAL1 -o $IFACE1
--dport $MCAST_PORT1 -j ACCEPT
iptables -A OUTPUT -p udp -d $MULTICAST_IP -s $IP_BAL2 -o $IFACE1
--dport $MCAST_PORT1 -j ACCEPT
iptables -A OUTPUT -p udp -d $MULTICAST_IP -s $MCAST_IFACE_IP1 -o
$IFACE2 --dport $MCAST_PORT1 -j ACCEPT
## Servicios
# Conexiones SSH a la VIP
iptables -A INPUT -i eth0 -p tcp --dport $SSH_PORT_EXT -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport $SSH_PORT_EXT -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport $SSH_PORT_EXT -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport $SSH_PORT_EXT -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport $SSH_PORT_IN -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --sport $SSH_PORT_IN -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --dport $SSH_PORT_IN -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --sport $SSH_PORT_IN -j ACCEPT
##
echo " OK . Verifique que lo que se aplica con: iptables -L -n"
# Fin del script
#
############################################

Sin otro particular se despide,
Gabriel M=F6ll Ibacache
Ingeniero Civil en Computaci=F3n
_______________________________________________
Ultramonkey-users mailing list
[email protected]
http://lists.vergenet.net/listinfo/ultramonkey-users