On Sun, May 28, 2017 at 8:17 AM, Andrew Dent adent@ctcroydon.com.au wrote:
Hi
I would like to add rules into the iptables of the Hosted Engine VM in Ovirt.
the version is oVirt Engine Version: 4.1.1.8-1.el7.centos I have tried using the normal process for iptables (iptables-save etc), but it seems that the file /etc/sysconfig/iptables this is ignored in the Ovirt Engine VM. How can I add permanent rules into the Engine VM?
Kind regards
Andrew
Hi, probably the oVirt users mailing list would be better than the general CentOS list; here archives and registration information: https://lists.ovirt.org/mailman/listinfo/users
That said, the hosted engine setup workflow should give you the option to configure the firewall too. Didn't you choose that option? Did you use the provided appliance or did you manage yourself the os installation and run of engine-setup inside the hosted engine vm?
I suppose you have iptables and not firewalld installed, so that the command
systemctl status firewalld
returns service not found, correct? Otherwise yo uhave to disable firewalld and enable iptables
For my hosted engine 4.1.1 test setup I have in place firewalld on CentOS 7.3, that is the default using the appliance, and these are the rules if I run
iptables -S > /tmp/itables-dump.txt
so you can convert them to /etc/sysconfig/iptables rules Note that the needed rules could change also depending on the oVirt related services you enable on the engine (eg ovirt-imageio-proxy that needs 54323 port open below, websocket proxy, ecc..)
[root@ractorshe ~]# cat /tmp/iptables-dump.txt -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N FORWARD_IN_ZONES -N FORWARD_IN_ZONES_SOURCE -N FORWARD_OUT_ZONES -N FORWARD_OUT_ZONES_SOURCE -N FORWARD_direct -N FWDI_public -N FWDI_public_allow -N FWDI_public_deny -N FWDI_public_log -N FWDO_public -N FWDO_public_allow -N FWDO_public_deny -N FWDO_public_log -N INPUT_ZONES -N INPUT_ZONES_SOURCE -N INPUT_direct -N IN_public -N IN_public_allow -N IN_public_deny -N IN_public_log -N OUTPUT_direct -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -j INPUT_direct -A INPUT -j INPUT_ZONES_SOURCE -A INPUT -j INPUT_ZONES -A INPUT -m conntrack --ctstate INVALID -j DROP -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i lo -j ACCEPT -A FORWARD -j FORWARD_direct -A FORWARD -j FORWARD_IN_ZONES_SOURCE -A FORWARD -j FORWARD_IN_ZONES -A FORWARD -j FORWARD_OUT_ZONES_SOURCE -A FORWARD -j FORWARD_OUT_ZONES -A FORWARD -m conntrack --ctstate INVALID -j DROP -A FORWARD -j REJECT --reject-with icmp-host-prohibited -A OUTPUT -j OUTPUT_direct -A FORWARD_IN_ZONES -i eth0 -g FWDI_public -A FORWARD_IN_ZONES -g FWDI_public -A FORWARD_OUT_ZONES -o eth0 -g FWDO_public -A FORWARD_OUT_ZONES -g FWDO_public -A FWDI_public -j FWDI_public_log -A FWDI_public -j FWDI_public_deny -A FWDI_public -j FWDI_public_allow -A FWDI_public -p icmp -j ACCEPT -A FWDO_public -j FWDO_public_log -A FWDO_public -j FWDO_public_deny -A FWDO_public -j FWDO_public_allow -A INPUT_ZONES -i eth0 -g IN_public -A INPUT_ZONES -g IN_public -A IN_public -j IN_public_log -A IN_public -j IN_public_deny -A IN_public -j IN_public_allow -A IN_public -p icmp -j ACCEPT -A IN_public_allow -p tcp -m tcp --dport 6641 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p tcp -m tcp --dport 6642 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p tcp -m tcp --dport 6100 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p tcp -m tcp --dport 9696 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p tcp -m tcp --dport 2222 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p tcp -m tcp --dport 54323 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p tcp -m tcp --dport 5432 -m conntrack --ctstate NEW -j ACCEPT -A IN_public_allow -p udp -m udp --dport 7410 -m conntrack --ctstate NEW -j ACCEPT
NOTE: 6641 and 6642 are for OVN setup ( http://www.ovirt.org/develop/release-management/features/ovirt-ovn-provider/) and probably you don't need them
If I run the dump from command "ip6tables -S" and then run a diff with the former file, you get an hint on how to create also your /etc/sysconfig/ip6tables file if you are using ipv6
[root@ractorshe ~]# diff /tmp/ip6tables-dump.txt /tmp/iptables-dump.txt 31c31 < -A INPUT -j REJECT --reject-with icmp6-adm-prohibited ---
-A INPUT -j REJECT --reject-with icmp-host-prohibited
40c40 < -A FORWARD -j REJECT --reject-with icmp6-adm-prohibited ---
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
49c49 < -A FWDI_public -p ipv6-icmp -j ACCEPT ---
-A FWDI_public -p icmp -j ACCEPT
58c58,60 < -A IN_public -p ipv6-icmp -j ACCEPT ---
-A IN_public -p icmp -j ACCEPT -A IN_public_allow -p tcp -m tcp --dport 6641 -m conntrack --ctstate NEW
-j ACCEPT
-A IN_public_allow -p tcp -m tcp --dport 6642 -m conntrack --ctstate NEW
-j ACCEPT 63d64 < -A IN_public_allow -d fe80::/64 -p udp -m udp --dport 546 -m conntrack --ctstate NEW -j ACCEPT [root@ractorshe ~]#
HIH, Gianluca