vCloud Director 5.1 RHEL Firewall Settings

vCloud Director 5.1.1安裝環境RHEL 6.2

/etc/sysconfig/iptables內容

# Generated by iptables-save v1.4.7 on Tue Mar 26 15:52:56 2013

*filter

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

:OUTPUT DROP [0:0]

:RH-Firewall-1-INPUT - [0:0]

-A INPUT -j RH-Firewall-1-INPUT

-A FORWARD -j RH-Firewall-1-INPUT

-A OUTPUT -j RH-Firewall-1-INPUT

-A RH-Firewall-1-INPUT -i lo -j ACCEPT

-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT

-A RH-Firewall-1-INPUT -p 50 -j ACCEPT

-A RH-Firewall-1-INPUT -p 51 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#Simple

# Begin listing vCloud Director Ports Needed

# vCloud WebServices & vCenter/ESX Connections

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT

# vCloud Optional

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

# SSH

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

# vCloud Remote Console

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 902 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 903 -j ACCEPT

#NFS

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 111 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --sport 111 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 111 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --sport 111 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 920 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --sport 920 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 920 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --sport 920 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 2049 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --sport 2049 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 2049 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --sport 2049 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 32803 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 32769 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 892 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 892 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 875 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 875 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 662 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 662 -j ACCEPT

#DNS

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT

#NTP

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 123 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 123 -j ACCEPT

#LDAP

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 389 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 389 -j ACCEPT

#SMTP

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 25 -j ACCEPT

#Syslog

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 514 -j ACCEPT

#vCenter & ESX

#-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 902 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 903 -j ACCEPT

#Default Microsoft SQL Connections

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 1433 -j ACCEPT

#Default Oracle Port Connections

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 1521 -j ACCEPT

#AMQP Messaging (if Server exists)

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5672 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 5672 -j ACCEPT

#ActiveMQ

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 61611 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 61616 -j ACCEPT

# End listing vCloud Director Ports Needed

COMMIT

# Completed on Tue Mar 26 15:52:56 2013

配置文件詳解：

# Generated by iptables-save v1.4.7 on Tue Mar 26 15:52:56 2013

#注釋說明

*filter

#使用filter表

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

:OUTPUT DROP [0:0]

:RH-Firewall-1-INPUT - [0:0]

#上面四條內容定義了內建的INPUT、FORWAARD、ACCEPT鏈，還創建了一個名為RH-Firewall-1-INPUT 的新鏈

-A INPUT -j RH-Firewall-1-INPUT

#上面這條規則將添加到INPUT鏈上，所有發往INPUT鏈上的數據包將跳轉到RH-Firewall-1 鏈上。

-A FORWARD -j RH-Firewall-1-INPUT

#上面這條規則將添加到FORWARD鏈上，所有發往FORWARD鏈上的數據包將跳轉到RH-Firewall-1 鏈上。

-A OUTPUT -j RH-Firewall-1-INPUT

#上面這條規則將添加到OUTPUT鏈上，所有發往OUTPUT鏈上的數據包將跳轉到RH-Firewall-1 鏈上。

-A RH-Firewall-1-INPUT -i lo -j ACCEPT

#上面這條規則將被添加到RH-Firewall-1-input鏈，它可以匹配所有的數據包，其中流入接口（-i）是一個環路接口(lo)，匹配這條規則的數據包將全部通過（ACCEPT），不會再使用別的規則來和它們進行比較。

-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT

#上面這條規則是允許所有的icmp包，-p后是協議如：icmp、tcp、udp，端口是在-p后面--sport源端口，--dport目的端口，-j 指定數據包發送目的地址后的動作如：ACCEPT、DROP、QUEUE等。

-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#-m state --state ESTABLISHED,RELATED這個條件表示所有處于ESTABLISHED或者RELATED狀態的包，策略都是接受的。

-A RH-Firewall-1-INPUT -m state --state NEW

#-A RH-Firewall-1-INPUT -m state --state NEW這個條件是當connection的狀態為初始連接(NEW)時候的策略。

其他策略見注釋說明。