In this scenario, each node has only one network card but the entire
cluster sits behind a firewall. This firewall should do at least the
following:
- Prevent IP spoofing from outside of the subnet.
- Prevent access to the relocation port of any of the nodes in the
cluster except from within the cluster.
The following iptables rules can be used on each node to prevent
migrations to that node from outside the subnet assuming the main
firewall does not do this for you:
# this command disables all access to the Xen relocation
# port:
iptables -A INPUT -p tcp --destination-port 8002 -j REJECT
# this command enables Xen relocations only from the specific
# subnet:
iptables -I INPUT -p tcp -{}-source 192.168.1.1/8 \
--destination-port 8002 -j ACCEPT
