Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

When using Corosync with two rings via multi-cast addresses (Port 5405) & (Port 5406) what iptables rules are required to allow two nodes to communicate optimally without giving any undue access and making the rules too lenient?

I current have:

iptables -A INPUT -p udp -m multiport --dports 5404,5405,5406 -j ACCEPT

Will that allow all the communication a Corosync/Pacemaker setup requires for both rings?

I have heard arguments that something like:

iptables -I INPUT 1 -m pkttype --pkt-type multicast -j ACCEPT

is required. However I cannot seem to replicate a situation where this assists if the first rule I listed above is already in place.

The Red Hat documentation would seem to support the first approach. There is some IBM documentation espousing the second but is it just a case of a rule that is far too lenient when the first would do the job equally well whilst leaving no unnecessary ports open?

I'm leaning more towards the first rule being sufficient but wanted to get some more opinions on the matter.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.