Configure firewall under CentOS7 to let Keepalived go

Keepalived is a lightweight HA clustering solution, but when the firewall is turned on, each node cannot perceive the state of other nodes, and each node is bound with virtual IP. Many articles on the Internet talk about configuring firewall to let tcp/112 go, which is invalid under CentOS7. The correct way is to configure let go vrrp protocol, as follows:

Firewall-cmd-- direct-- permanent-- add-rule ipv4 filter INPUT 0-- destination 224.0.0.18-- protocol vrrp-j ACCEPTfirewall-cmd-- direct-permanent-- add-rule ipv4 filter OUTPUT 0-- destination 224.0.0.18-- protocol vrrp-j ACCEPTfirewall-cmd-- reload

Keepalived uses vrrp multicast, and the default address is 224.0.0.18, so configure the firewall to let it go.

Check with ip addr after completion, the cluster is normal, only the primary node is bound to virtual IP, and the backup node will not be bound.