Create a Login appliance /opt/rocks/bin/rocks add appliance login membership=Login node=login /opt/rocks/bin/rocks set appliance attr login submit_host true /opt/rocks/bin/rocks set appliance attr login exec_host false /opt/rocks/bin/rocks set appliance attr login primary_net private /opt/rocks/bin/rocks add firewall appliance=login network=public \ output-network=private service="all" protocol="all" action="ACCEPT" \ chain="FORWARD" flags="-m state --state RELATED,ESTABLISHED" rulename="A50-FORWARD-RELATED" rulesrc="system" /opt/rocks/bin/rocks add firewall appliance=login network=private \ service="all" protocol="all" action="ACCEPT" chain="FORWARD" rulename="A60-FORWARD" rulesrc="system" /opt/rocks/bin/rocks add firewall appliance=login output-network=public \ service="nat" protocol="all" action="MASQUERADE" chain="POSTROUTING" rulename="MASQUERADE" rulesrc="system" /opt/rocks/bin/rocks add firewall appliance=login network=all service="8649" \ protocol="udp" action="REJECT" chain="INPUT" \ comment="block ganglia traffic from non-private interfaces" rulename="R10-GANGLIA-UDP" rulesrc="system" /opt/rocks/bin/rocks add firewall appliance=login network=all service="3306" \ protocol="tcp" action="REJECT" chain="INPUT" \ comment="block mysql traffic from non-private interfaces" rulename="R20-MYSQL-TCP" rulesrc="system" /opt/rocks/bin/rocks add firewall appliance=login network=all service="40000" \ protocol="tcp" action="REJECT" chain="INPUT" \ comment="block foundation mysql traffic from non-private interfaces" rulename="R30-FOUNDATION-MYSQL" rulesrc="system"