Hi, try the below rule
-A f0to1 -p udp -m udp -s <YOUR NETWORK/IP GOES HERE> -d 239.2.11.71 --dport 8649 -j ACCEPT You should add this to your guard dog interface or what ever you are using because likely on a restart you will lose the appended rule. You are right you should go to support on your firewall support forum (IE guarddog) if this has no luck for you. Good Luck, Ray On Wed, 2005-09-21 at 13:39, Peter Huskey wrote: > Thanks Raymond. I have unfortunately taken the easy way out with iptables > and have been using guarddog as a crutch, so I am a bit of a newbie to this. > I tried following the rules it had defined and running the following but my > syntax was incorrect: > > [EMAIL PROTECTED] huskeypm]# iptables -A f0to1 -d 239.2.11.71 -dport > 8649 > -j ACCEPT > iptables v1.2.8: multiple -d flags not allowed > Try `iptables -h' or 'iptables --help' for more information. > > Its definition of f0to1/f1to0 is: > > # Create the filter chains > # Create chain to filter traffic going from 'Internet' to 'Local' > ipchains -N f0to1 > # Create chain to filter traffic going from 'Local' to 'Internet' > ipchains -N f1to0 > # Add rules to the filter chains > > The rule it previously had for 8649 was > # Allow 'userdefined8' > ipchains -A f0to1 -p tcp --sport 0:65535 --dport 8649:8649 -j ACCEPT > ipchains -A f1to0 -p tcp ! -y --sport 8649:8649 --dport 0:65535 -j > ACCEPT > > Would you have any advice on how to precede your suggestion of (-d > 239.2.11.71 -dport 8649)? Or is something that either I need to figure out > for my own conf or redirect to a more appropriate networking list? > > Thanks in advance for your help and patience. > > pete > > > > -----Original Message----- > From: Raymond Pete [mailto:[EMAIL PROTECTED] > Sent: Wednesday, September 21, 2005 8:48 AM > To: Peter Huskey > Cc: [email protected] > Subject: Re: [Ganglia-general] possible iptables and gmetad problem > > Add a rule to accept the multicast traffic on the listening server with > the port multicasting too. Some firewalls block listening multicast > traffic. > > > -d 239.2.11.71 -dport 8649 > > > > On Wed, 2005-09-21 at 12:24, Peter Huskey wrote: > > Hi > > > > I have installed gmetad/gmond on my network primarily using the > > defaults described in the README, including using the mcast > > 239.2.11.71/8649 setting. I currently use guarddog to configure my > > iptables; within the program I opened ports 8649,8651 and 8652. With > > the firewall activated I can telnet to these ports from localhost and > > other nodes and none appear closes (8649 prints the metric info, 8651 > > prints the XML page). Nmap on these ports confirm that I am not > > imagining anything. However, if I run 'gstat -a' or look at the XML > > output, the nodes, even the one running gmetad appear to be down. If > > I shutdown iptables (service iptables stop), then after a few seconds > > qstat and the webpage show everything working correctly. I ran > > tcpdump for both cases (sans_firewall: firewall off, avec_firewall: > > firewall on) and I don't see anything overly different between the > > packets received at :8649 except for the id number [10.1.1.2 is my > > server running both gmetad and gmond]: > > > > > > > > avec_firewall:09:59:40.978538 10.1.1.2.2334 > 239.2.11.71.8649: [udp > > sum ok] udp 8 (DF) [ttl 1] (id 65249, len 36) > > > > avec_firewall:09:59:53.229866 10.1.1.2.2334 > 239.2.11.71.8649: [udp > > sum ok] udp 8 (DF) [ttl 1] (id 65250, len 36) > > > > avec_firewall:10:00:13.242172 10.1.1.2.2334 > 239.2.11.71.8649: [udp > > sum ok] udp 8 (DF) [ttl 1] (id 65251, len 36) > > > > sans_firewall:10:45:14.842308 10.1.1.2.2334 > 239.2.11.71.8649: [udp > > sum ok] udp 8 (DF) [ttl 1] (id 502, len 36) > > > > sans_firewall:10:45:34.854596 10.1.1.2.2334 > 239.2.11.71.8649: [udp > > sum ok] udp 8 (DF) [ttl 1] (id 503, len 36) > > > > > > > > Are there any other ports to which I should be paying attention or > > something else which would explain the strange behavior? I can > > provide add'l config info if needed. > > > > > > > > Thanks! > > > > pete > > > > > > > > > > > > >
