Re: iptables + ldirectord
Simon Horman <[email protected]> Mon, 31 Aug 2009 17:24:39 +1000
| Newsgroups | gmane.linux.highavailability.ultramonkey |
|---|---|
| Message-ID | <[email protected]> |
On Mon, Aug 10, 2009 at 01:13:07PM -0400, Gabriel Angel M=F6ll Ibacache wro= te: > Hello, > = > I'm trying to configure heartbeat + ldirectord + iptables. All works > fine with only NAT iptables rule, but when I try to change policy to > DROP and set the iptables rules for permiting traffic from and to > heartbeat and from and to the services defined in ldirectord.cf. Sorry, I'm not sure that I understand what the problem is. > = > Here is the heartbeat and iptables config: > = > [root@bal1 root]# cat /etc/ha.d/ldirectord.cf > checktimeout=3D60 > checkinterval=3D10 > autoreload=3Dyes > logfile=3D"/var/log/ldirectord.log" > quiescent=3Dyes > = > # Balanceo SSH > virtual=3D192.168.1.186:60000 > real=3D10.100.0.11:22 masq 100 > real=3D10.100.0.14:22 masq 100 > scheduler=3Drr > checktype=3Dconnect > protocol=3Dtcp > checktimeout=3D60 > = > [root@bal1 root]# cat /etc/ha.d/haresources > bal1 IPaddr2::192.168.1.186/24/eth0/192.168.1.255 \ > IPaddr2::10.100.0.1/24/eth1/10.100.0.255 \ > ldirectord::/etc/ha.d/ldirectord.cf \ > iptables \ > LVSSyncDaemonSwap::master::eth1 > = > = > = > IPTABLES RULES > = > #!/bin/sh > ## Habilito IP FORWARDING > echo 1 > /proc/sys/net/ipv4/ip_forward > ## Variables > DEFAULT_POLICY=3D"DROP" > MULTICAST_IP=3D"225.0.0.1" # multicast IP > IFACE1=3D"eth0" # NIC WAN > IFACE2=3D"eth1" # NIC LAN > IP_BAL1=3D"192.168.1.184" # load balancer 1 > IP_BAL2=3D"192.168.1.185" # load balancer 2 > IP_VIP=3D"192.168.1.186" # VIP > MCAST_IFACE_IP1=3D"10.100.0.11" # LAN host 1 > MCAST_IFACE_IP2=3D"10.100.0.14" # LAN host 2 > MCAST_PORT1=3D"694" # mcast port 1 > SSH_PORT_EXT=3D"60000" # SSH port externo > SSH_PORT_IN=3D"22" # SSH port interno > echo -n Aplicando Reglas de Firewall... > ## FLUSH de reglas > iptables -F > iptables -X > iptables -Z > iptables -t nat -F > ## Politicas por defecto > iptables -P INPUT $DEFAULT_POLICY > iptables -P OUTPUT $DEFAULT_POLICY > iptables -P FORWARD $DEFAULT_POLICY > # iptables -t nat -P PREROUTING $DEFAULT_POLICY > # iptables -t nat -P POSTROUTING $DEFAULT_POLICY > # Permite el trafico por el loopback > iptables -A INPUT -i lo -j ACCEPT > iptables -A OUTPUT -o lo -j ACCEPT > # Permito conexiones SSH > iptables -A INPUT -p tcp --dport 22 -j ACCEPT > iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT > iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT > iptables -A INPUT -p tcp --sport 22 -j ACCEPT > # Dejo pasar los paquetes ICMP > iptables -A INPUT -i eth0 -p ICMP -j ACCEPT > iptables -A OUTPUT -o eth0 -p ICMP -j ACCEPT > iptables -A INPUT -i eth1 -p ICMP -j ACCEPT > iptables -A OUTPUT -o eth1 -p ICMP -j ACCEPT > ## NAT > iptables -t nat -A POSTROUTING -p tcp -j SNAT --to-source $IP_VIP > # Multicast uses UDP. > iptables -A INPUT -d $MULTICAST_IP -j ACCEPT > iptables -A INPUT -p udp -m udp --dport $MCAST_PORT1 -j ACCEPT > iptables -A OUTPUT -p udp -d $MULTICAST_IP -s $IP_BAL1 -o $IFACE1 > --dport $MCAST_PORT1 -j ACCEPT > iptables -A OUTPUT -p udp -d $MULTICAST_IP -s $IP_BAL2 -o $IFACE1 > --dport $MCAST_PORT1 -j ACCEPT > iptables -A OUTPUT -p udp -d $MULTICAST_IP -s $MCAST_IFACE_IP1 -o > $IFACE2 --dport $MCAST_PORT1 -j ACCEPT > ## Servicios > # Conexiones SSH a la VIP > iptables -A INPUT -i eth0 -p tcp --dport $SSH_PORT_EXT -j ACCEPT > iptables -A OUTPUT -o eth0 -p tcp --sport $SSH_PORT_EXT -j ACCEPT > iptables -A OUTPUT -o eth0 -p tcp --dport $SSH_PORT_EXT -j ACCEPT > iptables -A INPUT -i eth0 -p tcp --sport $SSH_PORT_EXT -j ACCEPT > iptables -A INPUT -i eth1 -p tcp --dport $SSH_PORT_IN -j ACCEPT > iptables -A OUTPUT -o eth1 -p tcp --sport $SSH_PORT_IN -j ACCEPT > iptables -A OUTPUT -o eth1 -p tcp --dport $SSH_PORT_IN -j ACCEPT > iptables -A INPUT -i eth1 -p tcp --sport $SSH_PORT_IN -j ACCEPT > ## > echo " OK . Verifique que lo que se aplica con: iptables -L -n" > # Fin del script > # > ############################################ > = > Sin otro particular se despide, > Gabriel M=F6ll Ibacache > Ingeniero Civil en Computaci=F3n > _______________________________________________ > Ultramonkey-users mailing list > [email protected] > http://lists.vergenet.net/listinfo/ultramonkey-users _______________________________________________ Ultramonkey-users mailing list [email protected] http://lists.vergenet.net/listinfo/ultramonkey-users