OpenHPC: Configure Firewalld - Revision history

David: /* Setup a trusted internal zone */

2016-11-08T22:12:38Z

Setup a trusted internal zone

David at 22:03, 8 November 2016

2016-11-08T22:03:49Z

Jon: /* Configuring Firewalld to forward traffic between Internal and External Interfaces */

2016-03-09T14:14:34Z

Configuring Firewalld to forward traffic between Internal and External Interfaces

Jon: /* Add ports to the internal firewall to allow functionality such as SLURM, NFS and Ganglia */

2016-03-09T14:12:43Z

Add ports to the internal firewall to allow functionality such as SLURM, NFS and Ganglia

Adam: /* Configuring Firewalld to forward traffic between Internal and External Interfaces */

2015-12-21T13:21:55Z

Configuring Firewalld to forward traffic between Internal and External Interfaces

Adam: /* Configuring Firewalld to forward traffic between Internal and External Interfaces */

2015-12-16T11:15:29Z

Configuring Firewalld to forward traffic between Internal and External Interfaces

Adam: Created page with "== Configuring Firewalld to forward traffic between Internal and External Interfaces == firewall-cmd --zone=external --add-interface=eno2 --permanent firewall-cmd --zo..."

2015-12-16T11:13:11Z

Created page with "== Configuring Firewalld to forward traffic between Internal and External Interfaces == <syntaxhighlight> firewall-cmd --zone=external --add-interface=eno2 --permanent firewall-cmd --zo..."

New page

== Configuring Firewalld to forward traffic between Internal and External Interfaces ==

<syntaxhighlight>
firewall-cmd --zone=external --add-interface=eno2 --permanent
firewall-cmd --zone=internal --add-interface=eno1 --permanent

firewall-cmd --zone=external --add-masquerade --permanent
firewall-cmd --permanent --direct --passthrough ipv4 -t nat -I POSTROUTING -o eno2 -j MASQUERADE -s 10.10.10.0/24
firewall-cmd --permanent --zone=internal --add-service=dhcp
firewall-cmd --permanent --zone=internal --add-service=tftp
firewall-cmd --permanent --zone=internal --add-service=dns
firewall-cmd --permanent --zone=internal --add-service=http
firewall-cmd --permanent --zone=internal --add-service=nfs
firewall-cmd --permanent --zone=internal --add-servive=ssh
firewall-cmd --permanent --zone=internal --add-service=ssh
firewall-cmd --complete-reload
firewall-cmd --list-all-zones
</syntaxhighlight>

@@ Line 1: / Line 1: @@
 == Setup a trusted internal zone ==
 <syntaxhighlight>
 ################################################################################
 # Configure the firewall
@@ Line 8: / Line 15: @@
 systemctl enable firewalld.service
 systemctl start firewalld.service
-−
 # Allow all traffic on the internal cluster network interface
 firewall-cmd --permanent --zone=trusted --change-interface=${sms_eth_internal}
-−
 # Perform NAT for traffic going out the public interface
 firewall-cmd --permanent --zone=public --add-masquerade
 sysctl -w net.ipv4.ip_forward=1
 echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.d/ip_forward.conf
-−
 # Be restrictive on the external network interface
 firewall-cmd --permanent --zone=public --change-interface=${sms_eth_external}
-−
 # If there is an InfiniBand fabric, trust its traffic
 if [[ "${enable_infiniband}" == "true" ]]; then
      firewall-cmd --permanent --zone=trusted --change-interface=ib0
 fi
 # Reload rules for them to take effect

← Older revision		Revision as of 22:03, 8 November 2016
Line 1:		Line 1:
		+	== Setup a trusted internal zone ==
		+	<syntaxhighlight>
		+	################################################################################
		+	# Configure the firewall
		+	################################################################################
		+	# Ensure the firewall is active (some VM images don't include it)
		+	yum -y install firewalld
		+	systemctl enable firewalld.service
		+	systemctl start firewalld.service
		+
		+	# Allow all traffic on the internal cluster network interface
		+	firewall-cmd --permanent --zone=trusted --change-interface=${sms_eth_internal}
		+
		+	# Perform NAT for traffic going out the public interface
		+	firewall-cmd --permanent --zone=public --add-masquerade
		+	sysctl -w net.ipv4.ip_forward=1
		+	echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.d/ip_forward.conf
		+
		+	# Be restrictive on the external network interface
		+	firewall-cmd --permanent --zone=public --change-interface=${sms_eth_external}
		+
		+	# If there is an InfiniBand fabric, trust its traffic
		+	if [[ "${enable_infiniband}" == "true" ]]; then
		+	firewall-cmd --permanent --zone=trusted --change-interface=ib0
		+	fi
		+
		+	# Reload rules for them to take effect
		+	firewall-cmd --reload
		+	</syntaxhighlight>
		+
		+	== OLD CONFIG ==
		+
	== Configuring Firewalld to forward traffic between Internal and External Interfaces ==		== Configuring Firewalld to forward traffic between Internal and External Interfaces ==

@@ Line 32: / Line 32: @@
 firewall-cmd --permanent --zone=internal --add-port=8662/tcp
 firewall-cmd --permanent --zone=internal --add-port=8663/tcp
-firewall-cmd --permanent --zone=internal --add-port=8660/u
+firewall-cmd --permanent --zone=internal --add-port=8660/udp
 firewall-cmd --permanent --zone=internal --add-port=8661/udp
 firewall-cmd --permanent --zone=internal --add-port=8662/udp

@@ Line 2: / Line 2: @@
 <syntaxhighlight>
-firewall-cmd --zone=external --add-interface=eno2 --permanent
+firewall-cmd --zone=external --add-interface=enp1s0f1 --permanent
-firewall-cmd --zone=internal --add-interface=eno1 --permanent
+firewall-cmd --zone=internal --add-interface=enp1s0f0 --permanent
 firewall-cmd --zone=external --add-masquerade --permanent
-firewall-cmd --permanent --direct --passthrough ipv4 -t nat -I POSTROUTING -o eno2 -j MASQUERADE -s 10.10.10.0/24
+firewall-cmd --permanent --direct --passthrough ipv4 -t nat -I POSTROUTING -o enp1s0f1 -j MASQUERADE
 firewall-cmd --permanent --zone=internal --add-service=dhcp
 firewall-cmd --permanent --zone=internal --add-service=tftp

@@ Line 12: / Line 12: @@
 firewall-cmd --permanent --zone=internal --add-service=http
 firewall-cmd --permanent --zone=internal --add-service=nfs
 firewall-cmd --permanent --zone=internal --add-service=ssh
 firewall-cmd --complete-reload
 firewall-cmd --list-all-zones