Problem with Proxmox VE Cluster when using Shorewall firewall

[ictdude]

Problem with Proxmox VE Cluster when using Shorewall firewall.
What firewall ports need to be open to use Proxmox VE Cluster and
a Shorewall firewall ? I try to secure the Proxmox server bij using this:

http://ovhwiki.com/index.php/Firewall_and_router_with_Proxmox

So i use 2 servers 2 nodes master and slave. With out firewall all ok.

And after completing this firewall setup next problem could not sync. with nodes. logfile say:

proxwww 5071 500 Can't connect to localhost:50000 (connect: Connection refused)

Local host is not used with firewall rules !?

 

[dietmar]

proxwww 5071 500 Can't connect to localhost:50000 (connect: Connection refused)

Is 'pvetunnel' running? If not, try to start/restart

# /etc/init.d/pvetunnel stop
# /etc/init.d/pvetunnel start

Does that help?

 

[ictdude]

Is 'pvetunnel' running? If not, try to start/restart

# /etc/init.d/pvetunnel stop
# /etc/init.d/pvetunnel start

Does that help?

Thanx for the reply. I did see that the ClusterSync and ClusterTunnel service where stoped. i could not start them any more in the webgui of Proxmox.
This problem started after installing the firewall as described in the url.

When i removed the firewall software all went to normal again.

 

[dietmar]

Any hint in syslog when you start pvetunnel?

 

[ictdude]

Any hint in syslog when you start pvetunnel?

This is what its say: proxwww 5071 500 Can't connect to localhost:50000 (connect: Connection refused)

But maybe logfile of the firewall. Its strange that the error talks about the localhost. The local host is not used by the firewall rule. So bypassed the firewall. Need to know what ports are used bij VE cluster. I dont know if the remote node try to connect and give strange errors like this. Firewall out bound rules has no restriction. I will try to trouble shoot more. But i did not find info about what ports need to be open for the VE cluster to let the other node connect to the master node.

 

[tom]

This is what its say: proxwww 5071 500 Can't connect to localhost:50000 (connect: Connection refused)

But maybe logfile of the firewall. Its strange that the error talks about the localhost. The local host is not used by the firewall rule. So bypassed the firewall. Need to know what ports are used bij VE cluster. I dont know if the remote node try to connect and give strange errors like this. Firewall out bound rules has no restriction. I will try to trouble shoot more. But i did not find info about what ports need to be open for the VE cluster to let the other node connect to the master node.

The cluster communicates via SSH (default port 22, vmbr0)

 

[ictdude]

The cluster communicates via SSH (default port 22, vmbr0)

Thnx Tom for the information. I have 22 open in and out. I will dig some deeper today and check what the problem could be.