linux防火墙下允许keepalived组播

   最近在两台linux服务器里面安装keepalived，配置好后发现两台机器都是master状态，网上搜索发现是防火墙没有允许vrrp的组播，两台服务器分别是centos7和suse系统
上网找了很久才找到这两个系统下开放vrrp组播的方法，特此记之。


使用keepalived组播的话需要修改防火墙设置：

centos 6下面修改防火墙
vi /etc/sysconfig/iptables  增加这个
-A INPUT -p 112 -d 224.0.0.0/32 -j ACCEPT           #-p 112指定协议为112，也可-p vrrp即vrrp，keepalived组播地址是224.0.0.18

centos7下面改防火墙
firewall-cmd --direct --permanent --add-rule ipv4 filter INPUT 0 --in-interface enp4s0 --destination 224.0.0.18 --protocol vrrp -j ACCEPT
firewall-cmd --reload

suse下面修改防火墙
vi  /etc/sysconfig/SuSEfirewall2
将下面这行的注释去掉
FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom"     
并将下面这行注释掉
FW_CUSTOMRULES="" 

然后
vi /etc/sysconfig/scripts/SuSEfirewall2-custom

fw_custom_before_antispoofing() {
    # these rules will be loaded before any anti spoofing rules will be
    # loaded. Effectively the only filter lists already effective are
    # 1) allow any traffic via the loopback interface, 2) allow DHCP stuff,
    # 3) allow SAMBA stuff [2 and 3 only if FW_SERVICE_... are set to "yes"]
    # You can use this hook to prevent logging of uninteresting broadcast
    # packets or to allow certain packet through the anti-spoofing mechanism.

#example: allow incoming multicast packets for any routing protocol
#iptables -A INPUT  -j ACCEPT -d 224.0.0.0/24
#添加下面这行
iptables -A INPUT -p vrrp -j ACCEPT -d 224.0.0.18
   true
    }


修改防火墙后记得重启防火墙。
然后再看系统的ip地址，发现恢复正常，只有一台机器是master状态了。