4bf765758c
This patch works several files that were not in common use back into the documents they should live with. The intended end result of this activity is to make common as lean as possible so it can be more easily translated. Also: Don't include configdrive table in user-guide since it's not relevant for audience Change-Id: Iacd5c68c639e60e8c711cb18351543e477444299
49 lines
2.0 KiB
XML
49 lines
2.0 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
version="5.0"
|
|
xml:id="default_ports">
|
|
<title>Compute service node firewall requirements</title>
|
|
<para>Console connections for virtual machines, whether direct or through a proxy, are received
|
|
on ports <literal>5900</literal> to <literal>5999</literal>. You must configure the firewall
|
|
on each Compute service node to enable network traffic on these ports.</para>
|
|
<procedure>
|
|
<title>Configure the service-node firewall</title>
|
|
<step><para>On the server that hosts the Compute service, log in as <systemitem>root</systemitem>.</para></step>
|
|
<step>
|
|
<para>
|
|
Edit the <filename>/etc/sysconfig/iptables</filename>
|
|
file.
|
|
</para>
|
|
</step>
|
|
<step>
|
|
<para>
|
|
Add an INPUT rule that allows TCP traffic on ports
|
|
that range from <literal>5900</literal> to
|
|
<literal>5999</literal>:
|
|
</para>
|
|
<programlisting language="ini">-A INPUT -p tcp -m multiport --dports 5900:5999 -j ACCEPT</programlisting>
|
|
<para>
|
|
The new rule must appear before any INPUT rules that
|
|
REJECT traffic.
|
|
</para>
|
|
</step>
|
|
<step>
|
|
<para>
|
|
Save the changes to the
|
|
<filename>/etc/sysconfig/iptables</filename> file.
|
|
</para>
|
|
</step>
|
|
<step>
|
|
<para>
|
|
Restart the <systemitem>iptables</systemitem> service
|
|
to ensure that the change takes effect.
|
|
</para>
|
|
<screen><prompt>$</prompt> <userinput>service iptables restart</userinput></screen>
|
|
</step>
|
|
</procedure>
|
|
<para>The <systemitem>iptables</systemitem> firewall now enables incoming connections to the
|
|
Compute services. Repeat this process for each Compute service node.</para>
|
|
</section>
|