I just disabled and masked firewalld and went back to IPTables.
No problems after that.
I had to change fail2ban to work with IPTables by commenting out :
in /etc/fail2ban/jail.d/00-firewalld.conf - Do not delete the file.
Then I setup a new service to save and restore IPTables on shutdown and reboot as I describe here:
Before you start firewalld service you should specify parameters via config files.
I recommend to you to create file of rules for every service (GlusterFS, Pacemaker ...) and put in the file all ports that you need. For example (for pacemaker got from Configuring the iptables Firewall to Allow Cluster Components) /etc/firewalld/services/pacemaker.xml:
Easy. Just add the option --permanent to all your rules, e.g.
firewall-cmd --zone=trusted --add-port=1234/tcp --permanent
This will register rules in the permanent configuration but won't apply them, until you run the command
By the way, this is the recommended way to operate firewalld; if you don't use the --permanent option, ...
Sounds like knockd is a viable solution for your problem. Think of it like a combination lock using ports.
man page: https://linux.die.net/man/1/knockd
deprecated but useful tutorial: https://www.digitalocean.com/community/tutorials/how-to-use-port-knocking-to-hide-your-ssh-daemon-from-attackers-on-ubuntu
another deprecated article that outlines using ...
postgresql by default only listens on localhost (127.0.0.1 and ::1). To change this behavior you have to configure other listening addresses manually in postgresql.conf, normally located in $PGDATA.
To make postgres e.g. to listen also on the local address 10.0.10.156, you would have to specify the listen_addresses as follows.
listen_addresses = 'localhost,...