11
edits
Changes
m
''<code>Vzfirewall'' </code> tool allows you to open/close ports for incoming connections with no dependencies to foreign IP addresses. E.g. you may allow a hostname ''<code>release.prod.example.com'' </code> to connect to port 5432 of VE 1234 and leave all other ports closed by modifying <code>1234.conf </code> file adding multiline ''<code>FIREWALL'' </code> directive into it:
→Simple firewall configuration independent to IP addresses: vzfirewall
== Simple firewall configuration independent to IP addresses: vzfirewall ==
<pre>
</pre>
You must then run ''<code>vzfirewall -a'' </code> on your hardware node to apply changes made in <code>*.conf</code>.
Note that it is recommended to use hostnames instead of IP addresses here, so the configuration is persistent for VE movements to different IP-address: you just need to run ''<code>vzfirewall -a'' </code> again after movement. It is also reboot-safe, because applied to <code>/etc/sysconfig/iptables </code> (at RHEL systems).
Vzfirewall and its documentation are available at [http://en.dklab.ru/lib/dklab_vzfirewall/ http://en.dklab.ru/lib/dklab_vzfirewall/].
