Networking Issue

Quick Start

---

Overview
Working with iptables in Debian
Necessary Ports - Database Server
Necessary Ports - Open-ils Server
Testing port configuration connection

---

Overview

Network security is an important aspect of any distributed database, particularly one in which patron data is kept. Like any computer these days, Linux servers come with a configurable firewall referred to generically as iptables. The following is a description of the ports that need to be opened via iptables for Evergreen to work. Iptables is a very complicated topic that can take you into the depths of packet routing and network configuration. What follows is a simple primer that will allow you to get work done on Evergreen. For more information see References section. The assumption here is a two server (database and oils) configuration.

NOTE: Our ISP keeps our production servers behind a substantial firewall and coordination with them is essential. Any ports you open via iptables, also need to be opened in their firewall. This is done by contacting support after you've configured iptalbes.

---

Working with iptables in Debian

Viewing the current configuration

    sudo iptables -L

or

    sudo iptables -L -n

The latter command will generate exactly the same list as the former except the -n (numbers) switch renders the list of addresses in dot decimal form. Without -n the entries in the list are shown as hostnames. So with with iptables -L you see something like this:

    target     prot opt source                 destination
    ACCEPT     tcp  --  larry.isp.ca  currly.isp.ca dpt:ssh
    ACCEPT     tcp  --  moe.isp.ca  currly.isp.ca tcp dpt:ssh
    ACCEPT     tcp  --  larry.isp.ca currly.isp.ca tcp dpt:2301
    ACCEPT     tcp  --  moe.isp.ca  currly.isp.ca tcp dpt:2301

The same output with the -n option:

    target     prot     source               destination
    ACCEPT     tcp  --  10.104.94.4         10.104.100.168     tcp dpt:22
    ACCEPT     tcp  --  10.104.94.8         10.104.100.168     tcp dpt:22
    ACCEPT     tcp  --  10.104.94.4         10.104.100.168     tcp dpt:2301
    ACCEPT     tcp  --  10.104.94.8         10.104.100.168     tcp dpt:2301

NOTE: that the command requires the use of sudo to use.

In Debian Lenny there are two ways to change iptables. You can issue commands at the shell prompt using the iptables command. When you do this, it's important to nt