I'm trying to set up iptables for a Ceph cluster. I'm currently putting rules together for one of the monitor servers.

The monitor daemon listens on tcp/6789 (ip address removed as it is a public address):

# netstat -tunlp | grep ceph-mon
tcp        0      0 X.X.X.X:6789*               LISTEN      2612/ceph-mon

If I allow connections to tcp port 6789 and drop everything else the monitor is marked as down by the rest of the cluster:

iptables -F INPUT
iptables -A INPUT -p tcp --dport 6789 -j ACCEPT
iptables -A INPUT -j DROP

Confusingly, if I drop all connections to tcp port 6789 the cluster still operates:

iptables -F INPUT
iptbales -A INPUT -p tcp --dport 6789 -j DROP

If I allow connections with a source tcp port 6789 and drop everything else the cluster operates:

iptables -F INPUT
iptables -A INPUT -p tcp --sport 6789 -j ACCEPT
iptables -A INPUT -j DROP

This doesn't make sense to me, as the daemon is listening on port 6789, so tcp segments should have a destination port of 6789.

If I do a tcpdump for source port 6789 I can see incoming packets with a destination port of 56052 and a source port of 6789. This makes even less sense to me as there is nothing listening on port 56052 on the monitor server.

Am I missing something here? I'm using SLES12 and ceph 12.2.7, the FORWARD and OUTPUT chains have no rules, and the policy on all chains is ACCEPT

  • You should look for "stateful firewalling" and then "iptables stateful firewalling" documentation anywhere on internet, because you should probably be using it. Once it's understood, you should rephrase the question if you still have issues.
    – A.B
    Oct 11 '18 at 17:13

I had not enabled connection tracking, so when the monitor was trying to talk to other monitors the responses were not being allowed back through the firewall. I added the following rule to fix the issue:

iptables -I INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Thanks to A.B for the suggestion of looking at stateful firewalls.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.