Protocol vrrp在iptables和firewalld中的记录

前几天接触到了防火墙环境下的 keepalived脑 裂问题

做一个小小的后续mark

firewall-cmd --direct --permanent --add-rule ipv4 filter INPUT 0 --in-interface dmac-vc01v2058 --destination 224.0.0.18 --protocol vrrp -j ACCEPT

[root@centos7 ~]# nslookup vrrp.mcast.net
Server:		223.5.5.5
Address:	223.5.5.5#53

Non-authoritative answer:
Name:	vrrp.mcast.net
Address: 224.0.0.18

ps: [这个解析结果就很有意思]

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1    11840   18M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
2        1    29 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
3       67  7216 INPUT_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
4       67  7216 INPUT_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
5       67  7216 INPUT_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
6        0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
7       61  6736 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain INPUT_direct (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 ACCEPT     112  --  dmac-vc01v2058 *       0.0.0.0/0            224.0.0.18          

- just a mark waiting for the 鸽子