Re: [ClusterLabs] Clustered LVM with iptables issue

2015-09-11 Thread Vladislav Bogdanov
Hi Digimer, Be aware that SCTP support in both kernel and DLM _may_ have issues (as long as I remember it was not recommended to use at least in cman's version of DLM at least because of the leak of testing). I believe you can force use of TCP via dlm_controld parameters (or config

Re: [ClusterLabs] Clustered LVM with iptables issue

2015-09-11 Thread Michele Baldessari
On Thu, Sep 10, 2015 at 07:43:34PM -0400, Digimer wrote: > iptables -I INPUT -p sctp -j ACCEPT > > Got it working. Obviously, that needs to be tightened up. One potentially time-saving caveat: event though there is an sctp conntrack module, it does not currently support multi-homed connections

[ClusterLabs] Clustered LVM with iptables issue

2015-09-10 Thread Digimer
Hi all, I've hit another recent, odd issue. Since adding RRP, I can't start clvmd anymore if the iptables rules are in place. Starting clvmd sits there and eventually times out with rc=5. If I drop iptables, it works perfectly. From what I understand, clvmd uses dlm and corosync, so it

Re: [ClusterLabs] Clustered LVM with iptables issue

2015-09-10 Thread Digimer
On 10/09/15 06:31 PM, Noel Kuntze wrote: > > Hello Digimer, > > Pro tip: look at the 'multiport' module. You can substantially reduce the > number of rules with it. > Right now, I'm scratching my eyes out. > You can use `ss` or `netstat` to find out where clmvd wants to phone to. That > might

Re: [ClusterLabs] Clustered LVM with iptables issue

2015-09-10 Thread Digimer
On 10/09/15 06:54 PM, Noel Kuntze wrote: > > Hello Digimer, > > I initially assumed you were familiar with ss or netstat and simply > forgot about them. > Seems I was wrong. > > Check the output of this: `ss -tpn` and `ss -upn`. > Those commands give you the current open TCP and UDP

Re: [ClusterLabs] Clustered LVM with iptables issue

2015-09-10 Thread Noel Kuntze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hello Digimer, Pro tip: look at the 'multiport' module. You can substantially reduce the number of rules with it. Right now, I'm scratching my eyes out. You can use `ss` or `netstat` to find out where clmvd wants to phone to. That might be an

Re: [ClusterLabs] Clustered LVM with iptables issue

2015-09-10 Thread Digimer
For the record; Noel helped me on IRC. The problem was that sctp was now allowed in the firewall. The clue was: [root@node1 ~]# /etc/init.d/clvmd start Starting clvmd: Activating VG(s): [ OK ] ] syslog Sep 10 23:30:47 node1 kernel: