Filtering traffic on the metadata/house network interfaces

Moe · Xsan Master Joined: 04 May 2006 Posts: 61

What would be the easiest way to filter traffic going on network interfaces on OS X clients ?
I'd like to force OS X to direct any file sharing, bonjour, NFS on a certain interface, and block it on the metadata network interface

Changing the priority of the interfaces doesn't seem the best solution at one customer's site

Regards

matx · Xsan Master Joined: 15 Apr 2005 Posts: 378

"set service order" is meant to solve this kind of thing. Put the main LAN at the top. Xsan metadata network after it. All traffic except Xsan stuff will go through the main interface.

rberd · Been around the blocks Joined: 05 Oct 2009 Posts: 22

This is interesting as I am noticing something similar. I have the service order set correctly as mentioned, but every so often in Apple Remote Desktop I see the Metadata Network IP address listed for workstations and servers instead of the Public IP address.

JSamuel · Xsan Master Joined: 05 Jan 2011 Posts: 169

Apple's workflow would put the MDLAN at the lowest priority, and since we're talking static IPs anyway, a static internal IP with a tight subnet (ie: 255.255.255.0 - as I'll be surprised if you need more than 254 MDLAN IPv4 addresses!)

You could go a step further and make your settings on the switch (depending on layer and management capability) to drop other traffic but I doubt this is a good idea, nor found the need to even investigate this in the past (in any case, your MD switch is a seperate device)

brianwells · Xsan Master Joined: 22 Oct 2008 Posts: 80

How do your workstations and servers appear in DNS? I had both the public and metadata IP addresses showing up when I did a DNS query. It turned out that the computers were registering both IP addresses with the Active Directory domain controller for inclusion in DNS.

I was able to restrict registration to just the public IP address by following the steps in this Apple support article: http://support.apple.com/kb/HT3169

abstractrude · Xsan Master Joined: 13 Mar 2008 Posts: 860

hmm. this is a weird one. I really dont know what you would do other than a firewall. Run this on the localhost or the remote machine. Simply block all access except the xsan related ports. Easier on the remote machines...

morphenine · Xsan Master Joined: 22 Dec 2008 Posts: 126

In the past I've used ipfw and route settings on SAN machines to block certain traffic from traversing the metadata. You can also turn off bonjour for the metadata ports.

Moe · Xsan Master Joined: 04 May 2006 Posts: 61

Moe · Xsan Master Joined: 04 May 2006 Posts: 61