[SOLVED] what is the keepalived iptables port?

Michael Barto · 05-07-2015, 01:18 PM

For CentOS6, I have installed keepalived on two machine. When I run "ip addr list eth2" it shows that the virtual is active on both servers. When I turn the firewall off, it works correctly and failover moves the correctly from one machine to another. What port do I need to open?

When I turn the firewall off, I get the correct eded output

[root@usivnprdldbuh003 ~]# ip addr list eth2
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 00:19:b9:e9:4b:ff brd ff:ff:ff:ff:ff:ff
inet 192.168.201.20/24 brd 192.168.201.255 scope global eth2
inet 192.168.201.10/32 brd 192.168.201.255 scope global eth2
inet6 fe80::219:b9ff:fee9:4bff/64 scope link
valid_lft forever preferred_lft forever
[root@usivnprdldbuh003 ~]#

[root@usivnprdldbuh004 ~]# ip addr list eth2
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 00:19:b9:e8:f1:c8 brd ff:ff:ff:ff:ff:ff
inet 192.168.201.21/24 brd 192.168.201.255 scope global eth2
inet6 fe80::219:b9ff:fee8:f1c8/64 scope link
valid_lft forever preferred_lft forever
[root@usivnprdldbuh004 ~]#

And everything works. But if I turn on the firewall, I get exactly the same output for both
[root@usivnprdldbuh003 ~]# ip addr list eth2
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 00:19:b9:e9:4b:ff brd ff:ff:ff:ff:ff:ff
inet 192.168.201.20/24 brd 192.168.201.255 scope global eth2
inet 192.168.201.10/32 brd 192.168.201.255 scope global eth2
inet6 fe80::219:b9ff:fee9:4bff/64 scope link
valid_lft forever preferred_lft forever
[root@usivnprdldbuh003 ~]#

[root@usivnprdldbuh004 ~]# ip addr list eth2
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 00:19:b9:e8:f1:c8 brd ff:ff:ff:ff:ff:ff
inet 192.168.201.21/24 brd 192.168.201.255 scope global eth2
inet 192.168.201.10/32 brd 192.168.201.255 scope global eth2
inet6 fe80::219:b9ff:fee8:f1c8/64 scope link
valid_lft forever preferred_lft forever
[root@usivnprdldbuh004 ~]#

What port does it use to validate the network device.

unSpawn · 05-09-2015, 02:32 AM

Quote:

Originally Posted by Michael Barto

What port do I need to open?

Code:

 ~]$ getent networks mcast-base
mcast-base            224.0.0.0
# So you need something like:
/sbin/iptables -t filter -I INPUT -d 224.0.0.0/8 -j ACCEPT

 ~]$ getent protocols vrrp
vrrp                  112 VRRP
# So you also need something like:
/sbin/iptables -t filter -I INPUT -p vrrp -j ACCEPT

#*Also please don't post duplicate questions. It's inefficient and against the LQ Rules.