firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="0.0.0.0" port port="22" protocol="tcp" reject '
所有计算
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.15" port protocol="tcp" port="111" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.15" port protocol="tcp" port="5900" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.15" port protocol="tcp" port="5901" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.15" port protocol="tcp" port="5902" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.15" port protocol="tcp" port="5903" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.15" port protocol="tcp" port="5904" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.15" port protocol="tcp" port="5905" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.15" port protocol="tcp" port="5906" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.15" port protocol="tcp" port="8022" accept" --zone=internal
ubuntu14
ufw delete allow ssh
ufw allow proto tcp from 10.34.1.15 to any port 22
CentOS7
计算节点
systemctl start firewalld.service
firewall-cmd --zone=internal --change-interface=em1 --permanent
firewall-cmd --zone=trusted --change-interface=em2 --permanent
firewall-cmd --remove-service=ssh --permanent
firewall-cmd --set-default-zone=internal
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.15" port protocol="tcp" port="22" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.15" port protocol="tcp" port="1-65535" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.15" port protocol="udp" port="1-65535" accept"
控制节点
systemctl start firewalld.service
firewall-cmd --zone=internal --change-interface=em1 --permanent
firewall-cmd --zone=trusted --change-interface=em2 --permanent
firewall-cmd --remove-service=ssh --permanent
firewall-cmd --set-default-zone=internal
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.15" port protocol="tcp" port="22" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.16" port protocol="tcp" port="1-65535" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.17" port protocol="tcp" port="1-65535" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.16" port protocol="udp" port="1-65535" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.17" port protocol="udp" port="1-65535" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.83" port protocol="tcp" port="80" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.34.1.83" port protocol="tcp" port="6080" accept"
ufw allow proto tcp from 10.34.1.2 to any port 3306
ufw allow proto tcp from 10.34.1.2 to any port 2379
ufw allow proto tcp from 10.34.1.2 to any port 11211
ufw allow proto tcp from 10.34.1.2 to any port 5900
ufw allow proto tcp from 10.34.1.2 to any port 5901
ufw allow proto tcp from 10.34.1.2 to any port 5902
ufw allow proto tcp from 10.34.1.2 to any port 5903
ufw allow proto tcp from 10.34.1.2 to any port 5903
ufw allow proto tcp from 10.34.1.2 to any port 3306
ufw allow proto tcp from 10.34.1.2 to any port 2379
ufw allow proto tcp from 10.34.1.2 to any port 11211
ufw allow proto tcp from 10.34.1.5 to any port 3306
ufw allow proto tcp from 10.34.1.5 to any port 2379
ufw allow proto tcp from 10.34.1.5 to any port 11211
ufw allow proto tcp from 10.34.1.9 to any port 3306
ufw allow proto tcp from 10.34.1.9 to any port 2379
ufw allow proto tcp from 10.34.1.9 to any port 11211
ufw allow proto tcp from 10.34.1.9 to any port 5672
ufw allow proto tcp from 10.34.1.9 to any port 2380
ufw allow proto tcp from 10.34.1.9 to any port 4369
ufw allow proto tcp from 10.34.1.15 to any port 22
ufw allow proto udp from 10.34.1.2 to any port 123
ufw allow proto tcp from 10.34.1.2 to any port 5672
ufw allow proto tcp from 10.34.1.10 to any port 5901
ufw allow proto tcp from 10.34.1.10 to any port 5902
ufw allow proto tcp from 10.34.1.10 to any port 5903
ufw allow proto tcp from 10.34.1.10 to any port 5904
ufw allow proto tcp from 10.34.1.10 to any port 5905
ufw allow proto tcp from 10.34.1.10 to any port 5906
ufw allow proto tcp from 10.34.1.10 to any port 5907
ufw allow proto tcp from 10.34.1.10 to any port 5908
ufw allow proto tcp from 10.34.1.10 to any port 5909
ufw allow from 10.34.1.10
ufw allow proto tcp from 10.34.1.15 to any port 22
ufw default allow routed
/etc/sysctl.conf
net.ipv4.icmp_echo_ignore_all=1