When using Corosync with two rings via multi-cast addresses (Port 5405) & (Port 5406) what iptables rules are required to allow two nodes to communicate optimally without giving any undue access and making the rules too lenient?

I currently have:

iptables -A INPUT -p udp -m multiport --dports 5404,5405,5406 -j ACCEPT

Will that allow all the communication a Corosync/Pacemaker setup requires for both rings?

I have heard arguments that something like:

iptables -I INPUT 1 -m pkttype --pkt-type multicast -j ACCEPT

is required. However I cannot seem to replicate a situation where this assists if the first rule I listed above is already in place.

The Red Hat documentation would seem to support the first approach. There is some IBM documentation espousing the second but is it just a case of a rule that is far too lenient when the first would do the job equally well whilst leaving no unnecessary ports open?

I'm leaning more towards the first rule being sufficient but wanted to get some more opinions on the matter.

  • Have you been using the 1st rule successfully? Or have you also started using the 2nd one as well since you've asked this question? – Chris Dec 4 '14 at 17:49


See section: 4.1.1. Configure Firewall on Host

| improve this answer | |
  • Hi, and welcome to stackexchange! Please don't just link to external documentation though, since such links tend to get outdated or removed. Instead, it's preferable to have a short summary of the relevant information from the external link, followed by a "for more information, ..." kind of thing. – Wouter Verhelst May 25 '16 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.