Users Guide

A–Security Considerations
Managing Security
Doc No. TD-000971 Rev. 1
January 29, 2021 Page 172 Copyright © 2021 Marvell
SLES 11.x and SLES 10.x
To configure the firewall on SLES 10 and 11:
1. To check the firewall status (by default, the command shows chain and rules
set for the host), issue the following command:
# iptables -L
2. To add customized rules in iptables, provide the path for customized rules in
/etc/sysconfig/SuSEfirewall2:
FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom"
#FW_CUSTOMRULES=""
3. In the /etc/sysconfig/scripts/SuSEfirewall2-custom directory,
modify the
fw_custom_before_port_handling( ) function. To allow
the qlnxremote management agent to communicate with the outside world,
add the following rules:
# iptables -I INPUT 4 -p tcp -m state --state NEW -m tcp --dport 1:1024 -j
ACCEPT
# iptables -I INPUT 5 -p udp -m state --state NEW -m udp --dport 1:1024 -j
ACCEPT
4. In the /etc/sysconfig/scripts/SuSEfirewall2-custom directory,
modify the fw_custom_before_port_handling( ) function. To set
port 8080 for http and 8443 for https allowing QCS CLI servers to connect to
clients, add the following rules:
# iptables -I INPUT 6 -p tcp -m state --state NEW -m udp --dport 8080 -j ACCEPT
# iptables -I INPUT 7 -p udp -m state --state NEW -m udp --dport 8080 -j ACCEPT
# iptables -I INPUT 8 -p tcp -m state --state NEW -m udp --dport 8443 -j ACCEPT
# iptables -I INPUT 9 -p udp -m state --state NEW -m udp --dport 8443 -j ACCEPT
5. To reload customized rules at runtime, issue the following command:
# /etc/init.d/SuSEfirewall2_setup reload
NOTE
 The preceding commands reflect the default port numbers of 8080
for HTTP and 8443 for HTTPS. If different port numbers were
specified during QCS CLI installation, replace the port numbers in
the preceding commands with the port numbers specified during
installation.
 Providing the FW_CUSTOMRULES file path causes custom rules to
persist across reboots.