HP XC System Software Administration Guide Version 3.2

12.2.1 Opening a Temporary Port in the Firewall
The openipport command enables the superuser to open an IP service port in the firewall
using the following information:
• The port number to open
• The protocol to be used
• The list of interfaces on which the port is to be opened
NOTE: Use the openipport command judiciously. The port remains open unless or until the
node is reimaged, even if the node is rebooted.
Typically, you would use the openipport command for each defined interface except the
external interface.
The following example opens port 44 in the firewall for the udp protocol on the Admin,
Interconnect, and loopback interfaces on the current node. The --verbose option displays
error messages, if any.
Notes:
The commands in the following examples use line continuation with the backslash character (\)
to fit the commands horizontally on the page. You can enter these commands on one line.
The list of interfaces specified by the --interface option must not contain any space characters.
# openipport --port 44 --protocol udp \
--interface Admin,Interconnect,lo --verbose
The following example also opens port 44 in the firewall on node n3; this example uses the same
protocol and interface options as the previous example. The cexec command updates node n3
and ensures that a log file records this command.
# cexec -w n3 "openipport --port 44 --protocol udp \
--interface Admin,Interconnect,lo --verbose"
Except for the head node, the effect of this command is overwritten when the nodes are reimaged.
12.2.2 Opening an IP Port in the Firewall Persistently
The /etc/sysconfig/iptables.proto file was developed so that IP port openings in the
firewall persist after node reimaging.
During the operation of the nconfig command on each node, the
/etc/sysconfig/iptables.proto file on the head node is used to generate the
/etc/sysconfig/iptables file for each node in the HP XC system.
The form of the iptables.proto file is similar to the /etc/sysconfig/iptables file, with
the notable difference that the following mnemonics are used to represent the interface names:
• External (external network — Ethernet)
• Admin (administration network)
• Interconnect (system interconnect)
• lo (loopback)
These interface names, which are introduced with the -i option, resolve automatically to the
device name during the operation of the nconfig command on each node.
The following procedure updates the iptables.proto file to open port 389 using the tcp
protocol on the Interconnect and Administrative interfaces:
1. Log in as superuser on the head node.
2. Use the text editor of your choice to add the following lines to the
/etc/sysconfig/iptables.proto file:
12.2 Opening Ports in the Firewall 155