0

I'm trying to set up iptables for a Ceph cluster. I'm currently putting rules together for one of the monitor servers.

The monitor daemon listens on tcp/6789 (ip address removed as it is a public address):

# netstat -tunlp | grep ceph-mon tcp 0 0 X.X.X.X:6789 0.0.0.0:* LISTEN 2612/ceph-mon

If I allow connections to tcp port 6789 and drop everything else the monitor is marked as down by the rest of the cluster:

iptables -F INPUT iptables -A INPUT -p tcp --dport 6789 -j ACCEPT iptables -A INPUT -j DROP

Confusingly, if I drop all connections to tcp port 6789 the cluster still operates:

iptables -F INPUT iptbales -A INPUT -p tcp --dport 6789 -j DROP

If I allow connections with a source tcp port 6789 and drop everything else the cluster operates:

iptables -F INPUT iptables -A INPUT -p tcp --sport 6789 -j ACCEPT iptables -A INPUT -j DROP

This doesn't make sense to me, as the daemon is listening on port 6789, so tcp segments should have a destination port of 6789.

If I do a tcpdump for source port 6789 I can see incoming packets with a destination port of 56052 and a source port of 6789. This makes even less sense to me as there is nothing listening on port 56052 on the monitor server.

Am I missing something here? I'm using SLES12 and ceph 12.2.7, the FORWARD and OUTPUT chains have no rules, and the policy on all chains is ACCEPT

Improve this question
1
  • You should look for "stateful firewalling" and then "iptables stateful firewalling" documentation anywhere on internet, because you should probably be using it. Once it's understood, you should rephrase the question if you still have issues. Commented Oct 11, 2018 at 17:13

1 Answer 1

Reset to default
0

I had not enabled connection tracking, so when the monitor was trying to talk to other monitors the responses were not being allowed back through the firewall. I added the following rule to fix the issue:

iptables -I INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Thanks to A.B for the suggestion of looking at stateful firewalls.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.