Block_TCP_traffic_using_iptables

How can we block a certain TPC/IP channel for RAC Node Eviction testing ?

Use lsof to find the port we are interested in:

# lsof | egrep 'COMMAND|hrac2int' |  egrep 'UDP|COMMAND'

On hrac2 ( not OCR master Node ) 
COMMAND     PID      USER   FD      TYPE             DEVICE  SIZE/OFF       NODE NAME
ohasd.bin  2555      root  665u     IPv4              37296       0t0        UDP hrac2int:11083 
ntpd       2600       ntp   25u     IPv4              11979       0t0        UDP hrac2int:ntp 
gipcd.bin  2861      grid   36u     IPv4              32610       0t0        UDP hrac2int:37751 
ocssd.bin  2925      grid   54u     IPv4              33130       0t0        UDP hrac2int:18652 
octssd.bi  3185      root   44u     IPv4              36506       0t0        UDP hrac2int:28645 
evmd.bin   3206      grid   53u     IPv4              83358       0t0        UDP hrac2int:32005 
crsd.bin   3410      root   40u     IPv4              76677       0t0        UDP hrac2int:31482

Now let’s block UPD channel with port 18652 used by ocssd.bin process:

Note 192.168.17.172 is the IP address for our cluster interconnect:
# iptables -A OUTPUT -s   192.168.17.172 -p udp --sport  18652 -j DROP

Verify the rules now in place:
# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       udp  --  hrac2int             anywhere            udp spt:18652

Delete all  the rules and verify:

# iptables -F

Verifiy settings
# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

 

Leave a Reply

Your email address will not be published. Required fields are marked *