template-storm-client-iptables-rules.v4

*filter
# Set default policies to DROP, except for output traffic generated from the node itself.
# All traffic over public IP address should get dropped, unless one of the below rules
# overrides it.
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# All localhost traffic is ok
-A INPUT -i lo -j ACCEPT

# allow traffic from other storm cluster nodes to private IP address
-A INPUT -m set --match-set $CLUSTER_NAME-wl src -j ACCEPT

# allow traffic from ZK cluster nodes to private IP address
-A INPUT -m set --match-set $ZK_CLUSTER_NAME-wl src -j ACCEPT

# allow traffic like DNS lookups initiated from the machine
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# allow SSH 
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

# Allow access to storm-ui web app on port 80 only to whitelisted ipsets.
-A INPUT -p tcp -m tcp --dport 80 -m set --match-set $CLUSTER_NAME-uwls src -j ACCEPT
# If you wish instead to allow anybody to access port 80, comment the above rule and uncomment the below one:
#-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
COMMIT