如何使用 Firewalld 保護 Galera 節點？

Question

我在保護 Galera 集群中的節點時遇到問題。 我只是在每個節點上打開所需的端口，集群運行良好。 我現在想進一步限制訪問，因此只允許其他節點與該節點通信，我決定為此設置一個區域，當我使用此區域時，節點無法干凈地離開集群或重新加入集群。 我必須改回我的舊區域才能讓它再次工作。 我對防火牆規則不是很好，所以我假設我在區域設置中做錯了，任何建議都將不勝感激。

我正在使用 Almalinux 8、MariaDB 10.6 和 Firewalld。

這是我的區域 XML 文件的副本（我已經更改了 IP）

<?xml version="1.0" encoding="utf-8"?>
<zone target="DROP">
  <short>A_Node</short>
  <description>Zone for node of Galera Cluster</description>
  <service name="ssh"/>
  <service name="dhcpv6-client"/>
  <service name="cockpit"/>

<!-- Node A Rules -->
  <rule family="ipv4">
    <source address="3.3.3.3"/>
    <service name="mysql"/>
  </rule>
  <rule family="ipv4">
    <source address="3.3.3.3"/>
    <port port="3306" protocol="tcp"/>
  </rule>
  <rule family="ipv4">
    <source address="3.3.3.3"/>
    <port port="4444" protocol="tcp"/>
  </rule>
  <rule family="ipv4">
    <source address="3.3.3.3"/>
    <port port="4567" protocol="tcp"/>
  </rule>
  <rule family="ipv4">
    <source address="3.3.3.3"/>
    <port port="4567" protocol="udp"/>
  </rule>
  <rule family="ipv4">
    <source address="3.3.3.3"/>
    <port port="4568" protocol="tcp"/>
  </rule>

<!-- Node B Rules -->
  <rule family="ipv4">
    <source address="4.4.4.4"/>
    <service name="mysql"/>
  </rule>
  <rule family="ipv4">
    <source address="4.4.4.4"/>
    <port port="3306" protocol="tcp"/>
  </rule>
  <rule family="ipv4">
    <source address="4.4.4.4"/>
    <port port="4444" protocol="tcp"/>
  </rule>
  <rule family="ipv4">
    <source address="4.4.4.4"/>
    <port port="4567" protocol="tcp"/>
  </rule>
  <rule family="ipv4">
    <source address="4.4.4.4"/>
    <port port="4567" protocol="udp"/>
  </rule>
  <rule family="ipv4">
    <source address="4.4.4.4"/>
    <port port="4568" protocol="tcp"/>
  </rule>

<!-- Node C Rules -->
  <rule family="ipv4">
    <source address="5.5.5.5"/>
    <service name="mysql"/>
  </rule>
  <rule family="ipv4">
    <source address="5.5.5.5"/>
    <port port="3306" protocol="tcp"/>
  </rule>
  <rule family="ipv4">
    <source address="5.5.5.5"/>
    <port port="4444" protocol="tcp"/>
  </rule>
  <rule family="ipv4">
    <source address="5.5.5.5"/>
    <port port="4567" protocol="tcp"/>
  </rule>
  <rule family="ipv4">
    <source address="5.5.5.5"/>
    <port port="4567" protocol="udp"/>
  </rule>
  <rule family="ipv4">
    <source address="5.5.5.5"/>
    <port port="4568" protocol="tcp"/>
  </rule>

<!-- Node D Rules -->
  <rule family="ipv4">
    <source address="6.6.6.6"/>
    <service name="mysql"/>
  </rule>
  <rule family="ipv4">
    <source address="6.6.6.6"/>
    <port port="3306" protocol="tcp"/>
  </rule>
  <rule family="ipv4">
    <source address="6.6.6.6"/>
    <port port="4444" protocol="tcp"/>
  </rule>
  <rule family="ipv4">
    <source address="6.6.6.6"/>
    <port port="4567" protocol="tcp"/>
  </rule>
  <rule family="ipv4">
    <source address="6.6.6.6"/>
    <port port="4567" protocol="udp"/>
  </rule>
  <rule family="ipv4">
    <source address="6.6.6.6"/>
    <port port="4568" protocol="tcp"/>
  </rule>
</zone>

Answer 1

我解決了，我的規則中缺少<accept/>標簽。

<rule family="ipv4">
  <source address="1.1.1.1/24"/>
  <port port="3306" protocol="tcp"/>
  <accept/>
</rule>