The ideal firewall configuration for cluster components depends on the local environment, where you may need to take into account such considerations as whether the nodes have multiple network interfaces or whether off-host firewalling is present. The example here, which opens the ports that are generally required by a Pacemaker cluster, should be modified to suit local conditions.
Table 1.1, “Ports to Enable for High Availability Add-On”
shows the ports to enable for the Red Hat High Availability Add-On and provides an explanation for what the port is used for. You can enable all of these ports by means of the
daemon by executing the following commands.
firewall-cmd --permanent --add-service=high-availability
Table 1.1. Ports to Enable for High Availability Add-On
Required on all nodes (needed by the
pcsd Web UI and required for node-to-node communication)
It is crucial to open port 2224 in such a way that
pcs from any node can talk to all nodes in the cluster, including itself. When using the Booth cluster ticket manager or a quorum device you must open port 2224 on all related hosts, such as Booth arbiters or the quorum device host.
Required on all nodes if the cluster has any Pacemaker Remote nodes
crmd daemon on the full cluster nodes will contact the
pacemaker_remoted daemon on Pacemaker Remote nodes at port 3121. If a separate interface is used for cluster communication, the port only needs to be open on that interface. At a minimum, the port should open on Pacemaker Remote nodes to full cluster nodes. Because users may convert a host between a full node and a remote node, or run a remote node inside a container using the host's network, it can be useful to open the port to all nodes. It is not necessary to open the port to any hosts other than nodes.
Required on the quorum device host when using a quorum device with
corosync-qnetd. The default value can be changed with the
-p option of the
Required on corosync nodes if
corosync is configured for multicast UDP
Required on all corosync nodes (needed by
Required on all nodes if the cluster contains any resources requiring DLM (such as
TCP 9929, UDP 9929
Required to be open on all cluster nodes and booth arbitrator nodes to connections from any of those same nodes when the Booth ticket manager is used to establish a multi-site cluster.