HP XC System Software Administration Guide Version 3.1

NOTE: Use the openipport command judiciously. The port remains open unless or until the node is
reimaged, even if the node is rebooted.
Typically, you would use the openipport command for each defined interface except the external
interface.
The following example opens port 44 in the firewall for the udp protocol on the Admin, Interconnect,
and loopback interfaces on the current node. The --verbose option displays error messages, if any.
Notes:
The commands in the following examples use line continuation with the backslash character (\) to fit the
commands horizontally on the page. You can enter these commands on one line.
The list of interfaces specified by the --interface option must not contain any space characters.
# openipport --port 44 --protocol udp \
--interface Admin,Interconnect,lo --verbose
The following example also opens port 44 in the firewall on node n3; this example uses the same protocol
and interface options as the previous example. The cexec command updates node n3 and ensures that
a log file records this command.
# cexec -w n3 "openipport --port 44 --protocol udp \
--interface Admin,Interconnect,lo --verbose"
Except for the head node, the effect of this command is overwritten when the nodes are reimaged.
11.2.2 Opening an IP Port in the Firewall Persistently
The /etc/sysconfig/iptables.proto file was developed so that IP port openings in the firewall
persist after node reimaging.
During the operation of the nconfig command on each node, the /etc/sysconfig/iptables.proto
file on the head node is used to generate the /etc/sysconfig/iptables file for each node in the HP
XC system.
The form of the iptables.proto file is similar to the /etc/sysconfig/iptables file, with the notable
difference that the following mnemonics are used to represent the interface names:
• External (external network — Ethernet)
• Admin (administration network)
• Interconnect (system interconnect)
• lo (loopback)
These interface names, which are introduced with the -i option, resolve automatically to the device name
during the operation of the nconfig command on each node.
The following procedure updates the iptables.proto file to open port 389 using the tcp protocol on
the Interconnect and Administrative interfaces:
1. Log in as superuser on the head node.
2. Use the text editor of your choice to add the following lines to the
/etc/sysconfig/iptables.proto file:
Notes:
For clarity, the mnemonics for the interface are shown in bold and the noncomment lines span two
lines. Noncomment lines each must take only one line in the iptables.proto file.
These lines must be placed before the following line:
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
11.2 Opening Ports in the Firewall 145