Thanks Raymond. I have unfortunately taken the easy way out with iptables
and have been using guarddog as a crutch, so I am a bit of a newbie to this.
I tried following the rules it had defined and running the following but my
syntax was incorrect:
[EMAIL PROTECTED] huskeypm]# iptables -A f0to1 -d 239.2.11.71 -dport
8649
-j ACCEPT
iptables v1.2.8: multiple -d flags not allowed
Try `iptables -h' or 'iptables --help' for more information.
Its definition of f0to1/f1to0 is:
# Create the filter chains
# Create chain to filter traffic going from 'Internet' to 'Local'
ipchains -N f0to1
# Create chain to filter traffic going from 'Local' to 'Internet'
ipchains -N f1to0
# Add rules to the filter chains
The rule it previously had for 8649 was
# Allow 'userdefined8'
ipchains -A f0to1 -p tcp --sport 0:65535 --dport 8649:8649 -j ACCEPT
ipchains -A f1to0 -p tcp ! -y --sport 8649:8649 --dport 0:65535 -j
ACCEPT
Would you have any advice on how to precede your suggestion of (-d
239.2.11.71 -dport 8649)? Or is something that either I need to figure out
for my own conf or redirect to a more appropriate networking list?
Thanks in advance for your help and patience.
pete
-----Original Message-----
From: Raymond Pete [mailto:[EMAIL PROTECTED]
Sent: Wednesday, September 21, 2005 8:48 AM
To: Peter Huskey
Cc: [email protected]
Subject: Re: [Ganglia-general] possible iptables and gmetad problem
Add a rule to accept the multicast traffic on the listening server with
the port multicasting too. Some firewalls block listening multicast
traffic.
-d 239.2.11.71 -dport 8649
On Wed, 2005-09-21 at 12:24, Peter Huskey wrote:
> Hi
>
> I have installed gmetad/gmond on my network primarily using the
> defaults described in the README, including using the mcast
> 239.2.11.71/8649 setting. I currently use guarddog to configure my
> iptables; within the program I opened ports 8649,8651 and 8652. With
> the firewall activated I can telnet to these ports from localhost and
> other nodes and none appear closes (8649 prints the metric info, 8651
> prints the XML page). Nmap on these ports confirm that I am not
> imagining anything. However, if I run 'gstat -a' or look at the XML
> output, the nodes, even the one running gmetad appear to be down. If
> I shutdown iptables (service iptables stop), then after a few seconds
> qstat and the webpage show everything working correctly. I ran
> tcpdump for both cases (sans_firewall: firewall off, avec_firewall:
> firewall on) and I don't see anything overly different between the
> packets received at :8649 except for the id number [10.1.1.2 is my
> server running both gmetad and gmond]:
>
>
>
> avec_firewall:09:59:40.978538 10.1.1.2.2334 > 239.2.11.71.8649: [udp
> sum ok] udp 8 (DF) [ttl 1] (id 65249, len 36)
>
> avec_firewall:09:59:53.229866 10.1.1.2.2334 > 239.2.11.71.8649: [udp
> sum ok] udp 8 (DF) [ttl 1] (id 65250, len 36)
>
> avec_firewall:10:00:13.242172 10.1.1.2.2334 > 239.2.11.71.8649: [udp
> sum ok] udp 8 (DF) [ttl 1] (id 65251, len 36)
>
> sans_firewall:10:45:14.842308 10.1.1.2.2334 > 239.2.11.71.8649: [udp
> sum ok] udp 8 (DF) [ttl 1] (id 502, len 36)
>
> sans_firewall:10:45:34.854596 10.1.1.2.2334 > 239.2.11.71.8649: [udp
> sum ok] udp 8 (DF) [ttl 1] (id 503, len 36)
>
>
>
> Are there any other ports to which I should be paying attention or
> something else which would explain the strange behavior? I can
> provide add'l config info if needed.
>
>
>
> Thanks!
>
> pete
>
>
>
>
>
>
