Linux Pacemaker Failover Clustering/SQL Server Firewall Access Rules

Firewall Ports: Linux Pacemaker Multi-Subnet Cluster for SQL Server Availability Groups

Last updated: 2026-08-21 16:28:01

This document lists the firewall ports for a Linux Pacemaker Multi-Subnet Cluster that hosts SQL Server Availability Groups (AG). The ports are in order by function and by number, for the network and security teams.

Contents

Inter-node traffic: Allow every port in the tables below, Inbound and Outbound, between the cluster subnets.

Note: The subnets 10.10.33.192/26 and 10.20.33.192/26 are examples. The actual IP ranges depend on your environment.

1. Pacemaker, Corosync, and Clustering Ports

These ports keep quorum among the cluster nodes. The ports also send cluster state, manage the cluster, and connect the nodes to shared services for high availability.

Port(s) Protocol(s) Direction Component / Service Purpose
22 TCP Bi-directional SSH SSH for cluster management.
22 TCP Outbound Fencing (fence_ssh) Fencing (STONITH) through fence_ssh agents.
443 TCP Outbound Fencing (cloud/vCenter/IPMI) Fencing (STONITH) to cloud, vCenter, or IPMI APIs.
2224 TCP Bi-directional Pacemaker (pcsd daemon) Core cluster management for configuration and authentication. Also serves the pcsd HTTPS web UI on this same port.
3121 TCP Outbound Pacemaker Remote Full cluster nodes connect out to a remote/guest node's pacemaker_remoted. The remote node does not connect back on this port.
3260 TCP Outbound iSCSI Initiator Cluster nodes (initiators) connect out to the iSCSI target for SBD (fencing) or shared storage. The target does not connect back on this port.
5403 TCP Outbound Corosync (qnetd) Cluster nodes run corosync-qdevice and connect out to the qnetd arbitrator. The arbitrator does not connect back on this port.
5404-5412 UDP Bi-directional Corosync/KNET Core cluster heartbeat and messaging. Covers the KNET multi-link range for redundancy.
9929 TCP/UDP Bi-directional Booth Used for multi-site clustering arbitration.
21064 TCP Bi-directional DLM Distributed Lock Manager (necessary for GFS2/OCFS2).

2. SQL Server and Availability Group Ports

These ports handle client access and AG data synchronization on the Linux cluster nodes themselves.

Port(s) Protocol(s) Direction Component / Service Purpose
445 TCP Outbound SMB (backup volume) Mounts a Windows SMB/CIFS share on the cluster node to store or read SQL Server backups. The node connects out to the Windows share. The share does not connect back on this port. See note N1.
1433 TCP Inbound SQL Server/AG Listener Default connection for client access and the AG Listener. Clients connect in. The listener does not start this connection outbound.
1434 TCP/UDP Inbound SQL Server TCP for the Dedicated Administrator Connection (DAC). UDP for SQL Server Browser. A client connects to the two. The server never starts this connection.
5022 TCP Bi-directional AG Endpoint Core Availability Group communication for data synchronization.

3. Custom and Non-Standard Port Examples

This section lists ports that are not defaults. Open them only when necessary, for a custom application configuration, a named instance, or a specific resource agent.

Port(s) Protocol(s) Direction Component / Service Purpose
111 TCP/UDP Bi-directional NFS: RPC Portmapper Optional. Only open if this environment uses NFS for shared storage, backups, or logs. Resolves other RPC service ports (for example, MountD, RquotaD). See note N4.
662 TCP/UDP Bi-directional NFS: RPC Status Optional. Used by the NFS locking mechanism. Confirmed Bi-directional, regardless of server location. See note N4.
875 TCP/UDP Bi-directional NFS: RPC RquotaD Optional. Remote quota reporting for NFS. See note N4.
892 TCP/UDP Bi-directional NFS: RPC MountD Optional. Used to mount NFS file systems. See note N4.
2049 TCP/UDP Bi-directional NFS: Core Optional. Core file transfer port for Network File System. See note N4.
7788-7799 TCP Bi-directional DRBD Proxy Example port range for a resource agent that uses DRBD Proxy. See note N2.
14330 TCP Inbound SQL Server Instance Example custom port for a specific named instance (for example, SQLAG_PROD). Carries traffic for client connectivity and the AG Listener. Clients connect in.
32769 UDP Bi-directional NFS: RPC LockD (UDP) Optional. Used by the NFS locking mechanism. Confirmed Bi-directional, regardless of server location. See note N4.
32803 TCP Bi-directional NFS: RPC LockD (TCP) Optional. Used by the NFS locking mechanism. Confirmed Bi-directional, regardless of server location. See note N4.

4. Research and Reference URLs

The team used the following external documentation as the basis for the port requirements in this environment.

5. Document Notes

This section records the corrections made during review. It also lists the items where the document owner's confirmation is necessary.

Corrected (verified against current vendor documentation):

  • DRBD Proxy port: the source listed TCP 3389, the well-known RDP port. The correct range for DRBD and DRBD Proxy is TCP 7788-7799. Corrected in Section 3.
  • DAC terminology: the source called port 1434's TCP function the "Dedicated Admin Port (DAP)." The correct SQL Server term is the "Dedicated Administrator Connection (DAC)." Corrected in Section 2.
  • RPC LockD protocol label: row 32769 read "RPC LockD (DCP)," inconsistent with its own UDP protocol column and with the TCP-labeled row below it. Corrected to "(UDP)" in Section 1.
  • Port 443 "PCSD Web UI" row: removed as a duplicate. Port 2224 serves the pcsd web UI, the same port already listed for pcsd daemon traffic. Red Hat's pcsd documentation and the pcsd(8) man page confirm this. No separate pcsd service exists on port 443. The 2224 row's purpose text also states that this port serves the web UI.
  • Port 445 (SMB): moved from Section 1 to Section 2, and re-scoped. Microsoft's own Pacemaker-for-AG guide has zero mentions of SMB, Samba, NFS, or a file-share witness. corosync_votequorum handles quorum by itself. SMB only appears in Microsoft's SQL Server on Linux docs as the shared-storage backend for a Failover Cluster Instance (FCI), a different clustering model from AG. The confirmed purpose here is narrow: this port mounts a Windows SMB share to store or read SQL Server backup files. This is a client connection, outbound from the cluster node, not Bi-directional.
  • NFS ports (111, 662, 875, 892, 2049, 32769, 32803): moved from Section 1 to Section 3 and marked optional. Same reason as the SMB move: Microsoft's Pacemaker-for-AG guide has no NFS requirement anywhere, and the AG architecture is shared-nothing, so these ports are not core Pacemaker/Corosync/AG requirements. Open them only if this specific environment genuinely uses NFS for shared storage, backups, or logs.

Removed (Windows-only artifacts, not applicable to a Linux Pacemaker cluster):

  • Ports 135, 137, 138, 139: these are the Windows DCE/RPC Endpoint Mapper (135) and legacy NetBIOS-over-TCP/IP services (137/138/139). Standard Samba file sharing on Linux does not use them. Direct-hosted SMB on port 445 replaced this requirement, starting with SMB 2.0.2. Removed from Section 1.
  • Ports 49152-65535 (Dynamic Range): this is the Windows RPC/DCOM ephemeral port range used by Windows Server Failover Clustering. Linux SQL Server Availability Groups use fixed ports only (1433, 5022) and do not negotiate a dynamic RPC range. Removed from Section 2.

Direction corrected (verified against vendor/upstream documentation):

  • Port 3121 (Pacemaker Remote): changed Bi-directional to Outbound. Full cluster nodes connect out to a remote/guest node. The remote node never connects back on this port.
  • Port 3260 (iSCSI Initiator): changed Bi-directional to Outbound. The initiator (cluster node) connects out to the storage target. The target does not connect back.
  • Port 5403 (corosync-qnetd): changed Bi-directional to Outbound. Cluster nodes connect out to the qnetd arbitrator. The arbitrator does not connect back on this port.
  • Port 1433 (SQL Server/AG Listener), Port 1434 (DAC/Browser), Port 14330 (custom named instance): changed Bi-directional to Inbound. These are client-to-server connections. The SQL Server instance does not start them.

N1: SMB port (445): retained for one purpose only: mounting a Windows SMB share to store or read SQL Server backup files. Confirmed as Outbound from the cluster node. This is not a general Samba/CIFS file-sharing or AD-authentication use, and it is not inter-node traffic between cluster members. If the backup destination changes (a different protocol, or a Linux-hosted share instead of Windows), revisit this entry.

N2: DRBD Proxy applicability: confirm this resource agent is actually part of this cluster design before you open the 7788-7799 range.

N3: Scope: this document covers RHEL 8 and RHEL 10 only. Confirm which of the two applies to your environment before you use the reference links in Section 4.

N4: NFS ports (Section 3), optional, two direction groups:

These seven ports are not a Pacemaker/Corosync/AG requirement. Open them only if this environment genuinely uses NFS for shared storage, backups, or logs. Otherwise, leave them closed.

  • 111 (portmapper), 892 (mountd), 875 (rquotad), 2049 (core NFS): if you do use NFS, direction depends on where the NFS server role lives. For an external NAS or gateway, Outbound-from-nodes and Inbound-to-server are necessary. For a cluster node that acts as the NFS server, Bi-directional is necessary. Confirm the NFS server location before you rely on this direction.
  • 662 (rpc.statd), 32769/32803 (lockd/NLM): if you do use NFS, these are confirmed Bi-directional regardless of server location. NFS lock recovery uses SM_NOTIFY: whichever host, client or server, reboots sends a notification to every monitored peer. Either side can be the one that reboots. An inbound rule is necessary on each side for this reason. Source: statd(8) man page and Google Cloud Filestore's NFS locking documentation.

Comments

Post a Comment

Popular posts from this blog

Windows Server Failover Clustering/SQL Server Firewall Access Rules

This document defines the firewall rules required for a Multi-Subnet Windows Server Failover Cluster (WSFC) environment. It covers WSFC core communication, the WSFC dependency on Active Directory (AD), and SQL Server Availability Group (AG) communication. Use these rules when you request network access for a Multi-Subnet Cluster. This version corrects several rows to agree with current Microsoft documentation. See Verification Notes at the end of this document for the list of changes and sources. Table of Contents Best Practice: IP Specificity Critical Action: Review Ephemeral Port Ranges Section 1: Core WSFC and Active Directory Ports Section 2: SQL Server Database Engine and Availability Group Ports Section 3: SQL Server BI Stack Ports (Conditional) Section 4: Multi-Subnet / Cloud Deployment Ports (Conditional) Section 5: Official References Verification Notes Windows Server 2025 / SQL Server 2025 Notes Best Practice: IP Specificity Specify exact IP ad...
Read more

Windows Server Recommendations For AWS

Windows Server Recommendations for AWS.md Windows Server Recommendations for AWS Overview This document gives a high-level recommendation for building a Windows Server EC2 host in AWS. It also covers support for Windows Server Failover Clustering (WSFC). Table of Contents Table of Contents Overview EC2 Host Recommendations EC2 Network Recommendations EC2 Security Recommendations Security Group 1: Internal Region Traffic Security Group 2: Inbound Windows and SQL Server Access Security Group 3: Outbound Access Security Group 4: Cross-Region WSFC and AG Traffic EC2 O/S Recommendations Operating System Image Network Configuration Drive Configuration Patching and Drivers Backups EC2 Host Recommendations This section gives recommendations for an EC2 host in AWS. It covers instance type and storage. Use the r6idn or i3en instance type for a SQL Server host in AWS. Both instance types come with NVMe SSD storage. Use the NVMe SSD storage for te...
Read more

Requirements for SQL Server AlwaysOn Feature on a Windows Server Failover Cluster

Requirements for SQL Server AlwaysOn Feature on a Windows Server Failover Cluster.md This document targets Windows Server 2022 and SQL Server 2022. See Update Notes at the end of this document. That section lists what changed from the original 2012 version, and the reason for each change. Table of Contents Overview Terminology Windows Server Failover Clustering (WSFC) Cluster Name Object (CNO) Virtual Computer Object (VCO) Symmetric / Asymmetric Storage SQL Server Failover Clustered Instance (FCI) SQL Server Failover Clustered Instance CNAME (FCI CNAME) SQL Server Availability Group (AG) SQL Server Availability Group Listener (AGL) SQL Server Availability Group Listener CNAME (AGL CNAME) WSFC Requirements SQL Server FCI Requirements SQL Server Availability Group Requirements Update Notes Windows Server 2025 / SQL Server 2025 Notes Overview This document covers the SQL Server AlwaysOn feature. This includes the Failover Clustered Instance, the A...
Read more