Red Hat Bugzilla – Bug 450397
RHEL5.1: Firewall settings for multicast address poorly explained
Last modified: 2015-04-19 20:47:29 EDT
Description of problem:
Documentation of the iptables settings are incorrect for cluster in RHEL 5.1.
Version-Release number of selected component (if applicable):
Cluster_Administration RHEL 5.1 (2008-01-10T14:58)
Follow the instructions for building a cluster using the iptables settings in
chapter 2, and the luci instructions in chapter 3. The nodes will reboot,etc.
but will not join.
Steps to Reproduce:
1. Apply the iptables settings described in chapter 2, section 2.1 and 2.2 -
changing the IP address as appropriate for your nodes.
2. Install and start ricci and luci as per chapter 3, section 2.
3. Create and configure the cluster as per chapter 3, section 3.
We see the nodes reboot, etc., but the final join stage times out.
The cluster should start with all nodes joined.
The problem is with the firewall settings for the multicast socket. The
document gives us:
iptables -A INPUT -i 10.10.10.200 -m multiport -m state --state NEW -p udp
-s 10.10.10.0/24 -d 10.10.10.0/24 --dports 5404,5405 -j ACCEPT
This cannot work: the multicast socket has to be in the range 188.8.131.52 to
184.108.40.206. The firewall needs to be set so that the destination is the
multicast address, with the source as the unicast IP address of the interface.
On my configuration, I used the command:
iptables -A INPUT -s 192.168.2.0/255.255.255.0 -d 220.127.116.11/18.104.22.168 -p udp -m
state --state NEW -m multiport --dports 5404,5405 -j ACCEPT
By default, the cluster will be assigned a multicast address that is based on a
hash of the cluster name, and so will not be known in advance (hence the /4
setting on the destination). Perhaps the example in the manual should use a
fixed multicast address and apply more specific firewalling to it.
Created attachment 314141 [details]
Revised content in PDF and HTML printed to PDF.
Revised content in PDF and HTML printed to PDF is included.
Revised content is attached in both PDF and HTML output formats. Revised content has been reviewed and approved by subject matter expert. Fixed in 5.3 branch. Will merge with published versions.
Problem will be fixed in RHEL 5.3 and RHEL 5.2 versions.