I need to allow traffic between apcupsd on the host and the APC management card. When iptables is disabled, the host can communicate with the management card. However, when iptables is active, communications no longer occur.
I have tried to insert a rule as follows:
ACCEPT tcp 192.168.xxx.xxx/32 anywhere tcp dpt:apcupsd state NEW
as the next to last rule in the RH-Firewall-1-INPUT chain. (The IP address belongs to the APC management card.) The rule doesn't allow packets to/from apcupsd.
I am no iptables expert (we use FreeBSD) and I am not familiar with how the iptables rules are structured on the xcp-ng host. It appears to be specially tailored to xcp-ng.
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT udp -- anywhere anywhere udp dpt:bootps
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT udp -- anywhere anywhere ctstate NEW udp dpt:ha-cluster
ACCEPT tcp -- anywhere anywhere ctstate NEW tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere ctstate NEW tcp dpt:http
ACCEPT tcp -- anywhere anywhere ctstate NEW tcp dpt:https
ACCEPT tcp -- anywhere anywhere tcp dpt:21064
ACCEPT udp -- anywhere anywhere multiport dports hpoms-dps-lstn,netsupport
ACCEPT tcp -- 192.168.xxx.xxx/32 anywhere tcp dpt:apcupsd state NEW
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
#
Suggestions?