template-storm-iptables-rules.v4

*filter
# Set default policies to DROP, except for output traffic generated from the node itself.
# All traffic over public IP address should get dropped, unless one of the below rules
# overrides it.
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# All localhost traffic is ok
-A INPUT -i lo -j ACCEPT

# allow traffic from other storm cluster nodes to private IP address
-A INPUT -m set --match-set $CLUSTER_NAME-wl src -j ACCEPT

# allow traffic from ZK cluster nodes to private IP address
-A INPUT -m set --match-set $ZK_CLUSTER_NAME-wl src -j ACCEPT

# allow traffic like DNS lookups initiated from the machine
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# allow SSH 
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
COMMIT