防火墻在RAC上的配置-創(chuàng)新互聯(lián)

RAC兩臺服務(wù)器的/etc/hosts都是如下

10年積累的網(wǎng)站設(shè)計、成都網(wǎng)站制作經(jīng)驗(yàn)，可以快速應(yīng)對客戶對網(wǎng)站的新想法和需求。提供各種問題對應(yīng)的解決方案。讓選擇我們的客戶得到更好、更有力的網(wǎng)絡(luò)服務(wù)。我雖然不認(rèn)識你，你也不認(rèn)識我。但先網(wǎng)站設(shè)計后付款的網(wǎng)站建設(shè)流程，更有建寧免費(fèi)網(wǎng)站建設(shè)讓你可以放心的選擇與我們合作。

127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4

::1 localhost localhost.localdomain localhost6 localhost6.localdomain6

192.168.130.200 hdba hdba

192.168.130.201 hdbb hdbb hdbb

192.168.130.136 hdb-cluster-scan hdb-cluster-scan

192.168.130.137 hdba-vip hdba-vip

192.168.130.138 hdbb-vip hdbb-vip

192.168.148.200 hdba-priv hdba-priv

192.168.148.201 hdbb-priv hdbb-priv

192.168.130.208 hdg hdg

A實(shí)例服務(wù)器的ip信息

[root@hdba ~]# ifconfig

eth0 Link encap:Ethernet HWaddr 5C:B9:01:99:3A:84

inet addr:192.168.148.200 Bcast:192.168.148.255 Mask:255.255.255.0

inet6 addr: fe80::5eb9:1ff:fe99:3a84/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:2783160300 errors:0 dropped:0 overruns:0 frame:0

TX packets:2925124606 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:2205601483366 (2.0 TiB) TX bytes:2420649621403 (2.2 TiB)

eth0:1 Link encap:Ethernet HWaddr 5C:B9:01:99:3A:84

inet addr:169.254.221.245 Bcast:169.254.255.255 Mask:255.255.0.0

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

eth2 Link encap:Ethernet HWaddr 5C:B9:01:99:3A:85

inet addr:192.168.130.200 Bcast:192.168.130.255 Mask:255.255.255.0

inet6 addr: fe80::5eb9:1ff:fe99:3a85/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:7365390091 errors:0 dropped:0 overruns:0 frame:0

TX packets:8297092138 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:2046603688342 (1.8 TiB) TX bytes:6835745161060 (6.2 TiB)

eth2:2 Link encap:Ethernet HWaddr 5C:B9:01:99:3A:85

inet addr:192.168.130.137 Bcast:192.168.130.255 Mask:255.255.255.0

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

B實(shí)例服務(wù)器的ip信息

[root@hdbb ~]# ifconfig

eth0 Link encap:Ethernet HWaddr 5C:B9:01:99:38:24

inet addr:192.168.148.201 Bcast:192.168.148.255 Mask:255.255.255.0

inet6 addr: fe80::5eb9:1ff:fe99:3824/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:2925138277 errors:0 dropped:0 overruns:0 frame:0

TX packets:2783173132 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:2420675528287 (2.2 TiB) TX bytes:2205594234468 (2.0 TiB)

eth0:1 Link encap:Ethernet HWaddr 5C:B9:01:99:38:24

inet addr:169.254.205.69 Bcast:169.254.255.255 Mask:255.255.0.0

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

eth2 Link encap:Ethernet HWaddr 5C:B9:01:99:38:25

inet addr:192.168.130.201 Bcast:192.168.130.255 Mask:255.255.255.0

inet6 addr: fe80::5eb9:1ff:fe99:3825/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:6957519128 errors:0 dropped:0 overruns:0 frame:0

TX packets:8365702494 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:2024616025362 (1.8 TiB) TX bytes:7204587376017 (6.5 TiB)

eth2:1 Link encap:Ethernet HWaddr 5C:B9:01:99:38:25

inet addr:192.168.130.138 Bcast:192.168.130.255 Mask:255.255.255.0

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

兩臺服務(wù)器的防火墻配置都一樣，配置文件/etc/sysconfig/iptables內(nèi)容如下

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

#來自心跳網(wǎng)卡的數(shù)據(jù)都放行

-A INPUT -i eth0 -j ACCEPT

-A INPUT -i eth0:1 -j ACCEPT

#vip和scan ip放行

#本來A實(shí)例的vip去訪問B實(shí)例，在B實(shí)例防火墻添加A實(shí)例的vip，為了使兩臺服務(wù)器的防火墻配置一樣，就把A實(shí)例和B實(shí)例的vip都放行

-A INPUT -i eth0 -s 192.168.130.200/32 -j ACCEPT

-A INPUT -i eth0 -s 192.168.130.201/32 -j ACCEPT

-A INPUT -i eth0 -s 192.168.130.137/32 -j ACCEPT

-A INPUT -i eth0 -s 192.168.130.138/32 -j ACCEPT

-A INPUT -i eth0 -s 192.168.130.136/32 -j ACCEPT

-A INPUT -i eth0 -s 192.168.200.11/32 -j ACCEPT

#信任IP列表，/24表示整個網(wǎng)段都開放，/32表示只開放這個IP

-A INPUT -s 10.10.23.0/24 -p tcp -m state --state NEW -m tcp --dport 1521 -j ACCEPT

-A INPUT -s 172.31.210.0/24 -p tcp -m state --state NEW -m tcp --dport 1521 -j ACCEPT

-A INPUT -s 192.168.74.0/24 -p tcp -m state --state NEW -m tcp --dport 1521 -j ACCEPT

-A INPUT -s 192.168.128.137/32 -p tcp -m state --state NEW -m tcp --dport 1521 -j ACCEPT

#對全部網(wǎng)段開放1521端口
-A INPUT -p tcp --dport 1521 -j ACCEPT

#下面兩行要放到最后，如果放在前面會創(chuàng)成加入的放行不生效！

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

分享文章：防火墻在RAC上的配置-創(chuàng)新互聯(lián)
分享鏈接：http://muchs.cn/article14/dgcoge.html

成都網(wǎng)站建設(shè)公司_創(chuàng)新互聯(lián)，為您提供面包屑導(dǎo)航、網(wǎng)站建設(shè)、標(biāo)簽優(yōu)化、關(guān)鍵詞優(yōu)化、微信公眾號、靜態(tài)網(wǎng)站

聲明：本網(wǎng)站發(fā)布的內(nèi)容（圖片、視頻和文字）以用戶投稿、用戶轉(zhuǎn)載內(nèi)容為主，如果涉及侵權(quán)請盡快告知，我們將會在第一時間刪除。文章觀點(diǎn)不代表本網(wǎng)站立場，如需處理請聯(lián)系客服。電話：028-86922220；郵箱：631063699@qq.com。內(nèi)容未經(jīng)允許不得轉(zhuǎn)載，或轉(zhuǎn)載時需注明來源：創(chuàng)新互聯(lián)

猜你還喜歡下面的內(nèi)容