The current firewall rules for the HPC Solution have the following
catch-all rules in the INPUT part:
  
        for dev in private_nics:
            filter += '-A FORWARD -i %s ' % dev + \
                      '-o %s -m state ' % public + \
                      '--state RELATED,ESTABLISHED -j ACCEPT\n'
            filter += '-A FORWARD -i %s -j ACCEPT\n' % dev
            filter += '-A INPUT -i %s -j ACCEPT\n' % dev
        filter += '-A INPUT -i lo -j ACCEPT\n'
        filter += '-A INPUT -p icmp --icmp-type any -j ACCEPT\n'
        filter += '-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n'
        filter += '-A INPUT -i %s -p tcp --dport 0:1024 -j REJECT\n' % public
        filter += '-A INPUT -i %s -p udp --dport 0:1024 -j REJECT\n' % public

That leaves ports higher than 1024 available for remote connections from
public networks. We think that that is dangerous and we would prefer the
last two to be consolidated into one much stricter rule:
        filter += '-A INPUT -i %s -j REJECT\n' % public

Also there would be need for additional rules to open the public ports used by ntop, cacti, or nagios, etc.