In order to use the --dport and other useful protocol dependent options, you need tell iptables to load the extended packet matching modules, either implicitly by specifying the tcp/udp protocols (-p/--protocol option) or explicitly with the -m/--match option. See the iptables man page for more info.
~Jason On Wed, 2005-09-21 at 10:39 -0700, Peter Huskey wrote: > Thanks Raymond. I have unfortunately taken the easy way out with iptables > and have been using guarddog as a crutch, so I am a bit of a newbie to this. > I tried following the rules it had defined and running the following but my > syntax was incorrect: > > [EMAIL PROTECTED] huskeypm]# iptables -A f0to1 -d 239.2.11.71 -dport > 8649 > -j ACCEPT > iptables v1.2.8: multiple -d flags not allowed > Try `iptables -h' or 'iptables --help' for more information. > > Its definition of f0to1/f1to0 is: > > # Create the filter chains > # Create chain to filter traffic going from 'Internet' to 'Local' > ipchains -N f0to1 > # Create chain to filter traffic going from 'Local' to 'Internet' > ipchains -N f1to0 > # Add rules to the filter chains > > The rule it previously had for 8649 was > # Allow 'userdefined8' > ipchains -A f0to1 -p tcp --sport 0:65535 --dport 8649:8649 -j ACCEPT > ipchains -A f1to0 -p tcp ! -y --sport 8649:8649 --dport 0:65535 -j > ACCEPT > > Would you have any advice on how to precede your suggestion of (-d > 239.2.11.71 -dport 8649)? Or is something that either I need to figure out > for my own conf or redirect to a more appropriate networking list? > > Thanks in advance for your help and patience. > > pete > > > > -----Original Message----- > From: Raymond Pete [mailto:[EMAIL PROTECTED] > Sent: Wednesday, September 21, 2005 8:48 AM > To: Peter Huskey > Cc: [email protected] > Subject: Re: [Ganglia-general] possible iptables and gmetad problem > > Add a rule to accept the multicast traffic on the listening server with > the port multicasting too. Some firewalls block listening multicast > traffic. > > > -d 239.2.11.71 -dport 8649 > > > > On Wed, 2005-09-21 at 12:24, Peter Huskey wrote: > > Hi > > > > I have installed gmetad/gmond on my network primarily using the > > defaults described in the README, including using the mcast > > 239.2.11.71/8649 setting. I currently use guarddog to configure my > > iptables; within the program I opened ports 8649,8651 and 8652. With > > the firewall activated I can telnet to these ports from localhost and > > other nodes and none appear closes (8649 prints the metric info, 8651 > > prints the XML page). Nmap on these ports confirm that I am not > > imagining anything. However, if I run 'gstat -a' or look at the XML > > output, the nodes, even the one running gmetad appear to be down. If > > I shutdown iptables (service iptables stop), then after a few seconds > > qstat and the webpage show everything working correctly. I ran > > tcpdump for both cases (sans_firewall: firewall off, avec_firewall: > > firewall on) and I don't see anything overly different between the > > packets received at :8649 except for the id number [10.1.1.2 is my > > server running both gmetad and gmond]: > > > > > > > > avec_firewall:09:59:40.978538 10.1.1.2.2334 > 239.2.11.71.8649: [udp > > sum ok] udp 8 (DF) [ttl 1] (id 65249, len 36) > > > > avec_firewall:09:59:53.229866 10.1.1.2.2334 > 239.2.11.71.8649: [udp > > sum ok] udp 8 (DF) [ttl 1] (id 65250, len 36) > > > > avec_firewall:10:00:13.242172 10.1.1.2.2334 > 239.2.11.71.8649: [udp > > sum ok] udp 8 (DF) [ttl 1] (id 65251, len 36) > > > > sans_firewall:10:45:14.842308 10.1.1.2.2334 > 239.2.11.71.8649: [udp > > sum ok] udp 8 (DF) [ttl 1] (id 502, len 36) > > > > sans_firewall:10:45:34.854596 10.1.1.2.2334 > 239.2.11.71.8649: [udp > > sum ok] udp 8 (DF) [ttl 1] (id 503, len 36) > > > > > > > > Are there any other ports to which I should be paying attention or > > something else which would explain the strange behavior? I can > > provide add'l config info if needed. > > > > > > > > Thanks! > > > > pete > > > > > > > > > > > > > > > ------------------------------------------------------- > SF.Net email is sponsored by: > Tame your development challenges with Apache's Geronimo App Server. > Download it for free - -and be entered to win a 42" plasma tv or your very > own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php > _______________________________________________ > Ganglia-general mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/ganglia-general > -- /------------------------------------------------------------------\ | Jason A. Smith Email: [EMAIL PROTECTED] | | Atlas Computing Facility, Bldg. 510M Phone: (631)344-4226 | | Brookhaven National Lab, P.O. Box 5000 Fax: (631)344-7616 | | Upton, NY 11973-5000 | \------------------------------------------------------------------/
