OCF_HEARTBEAT_PORTBL(7)

💅 ocf_heartbeat_portblock — OCF resource agents 🎀

okay bestie, welcome to the ocf_heartbeat_portblock era — an OCF resource agent page and honestly? it's giving network bouncer energy. let's get into it ✨

---

🌸 NAME

ocf_heartbeat_portblock — blocks and unblocks access to TCP and UDP ports. that's it, that's the gig 💅

---

✨ SYNOPSIS

portblock [start | stop | status | monitor | promote | demote |
          meta-data | validate-all]

---

🦋 DESCRIPTION

so this is the resource script for portblock, and what it does is block ports using nftables or iptables. iconic behavior. on top of that, it may allow for faster TCP reconnects for clients on failover — use that if there are long lived TCP connections to an HA service 🫶

the way you turn that feature on is by setting the tickle_dir parameter, and it only works in concert with action set to unblock. iykyk.

🍼 heads up bestie: the tickle ACK function is new as of version 3.0.2 and hasn't yet seen widespread use. so like… it's cute, it's fresh, it's lowkey unproven. ngl, ship it with your eyes open 💀

and in Promotable mode? okay so the promote action unblocks the port(s) on the Promoted node and blocks the port(s) on the Unpromoted node(s) when action=unblock — and vice versa when action=block. main character energy, honestly 👑

---

💖 SUPPORTED PARAMETERS

• firewall — which firewall to use. e.g. auto (default), nft, or iptables. (optional, string, default "auto")
• protocol — the protocol that's getting blocked/unblocked. (required, string, no default) 🚨 you gotta give us this one
• portno — the port number that's getting blocked/unblocked. (required, string, no default)
• action — the action (block/unblock) to be done on the protocol::portno. ✨

in Promotable mode it's the action for the promote action, and the opposite action gets used for the start and demote actions. sneaky but slay.

(required, string, no default)

• method — the block method, choose your fighter:
  • drop: use a DROP rule.
  • reject: use a REJECT rule with conntrack to clear connections when blocking.

(optional, string, default "drop")

• status_check — the status check style:
  • rule: check the rule.
  • pseudo: check pseudo status when the rule is absent.

(optional, string, default "pseudo")

• reset_local_on_unblock_stop — okay bestie, story time 😭 if for some reason the long lived server side TCP sessions won't be cleaned up by a reconfiguration/flush/stop of whatever services this portblock protects, they would linger in the connection table — even after the IP is gone and services have been switched over to another node. messy.

an example would be the default NFS kernel server 🍓

these "known" connections may seriously confuse and delay a later switchback. not the vibe.

enabling this option will cause this agent to try to get rid of these connections by injecting a temporary iptables rule to TCP-reset outgoing packets from the blocked ports, and additionally tickle them locally, just before it starts to DROP incoming packets on "unblock stop". literally doing the most, but for a good reason 💅

(optional, boolean, default false)

• ip — the IP address that's getting blocked/unblocked. (optional, string, default "0.0.0.0/0")
• tickle_dir — the shared or local directory (must be an absolute path, fr fr) which stores the established TCP connections. (optional, string, no default)
• sync_script — if tickle_dir is a local directory, then the TCP connection state file has to be replicated to other nodes in the cluster. it can be csync2 (default), some wrapper of rsync, or whatever. it takes the file name as a single argument. for csync2, set it to "csync2 -xv". 🧚 (optional, string, no default)
• direction — whether to block incoming or outgoing traffic. can be either "in", "out", or "both".
  • "in" → the incoming ports are blocked on the INPUT chain.
  • "out" → the outgoing ports are blocked on the OUTPUT chain.
  • "both" → both the incoming and outgoing ports are blocked.

(optional, string, default "in")

---

👑 SUPPORTED ACTIONS

this resource agent supports the following actions (operations):

• start — starts the resource. suggested minimum timeout: 20s.
• stop — stops the resource. suggested minimum timeout: 20s.
• promote — promotes the resource to the Master role. suggested minimum timeout: 10s.
• demote — demotes the resource to the Slave role. suggested minimum timeout: 10s.
• status — performs a status check. suggested minimum timeout: 10s. suggested interval: 10s.
• monitor — performs a detailed status check. suggested minimum timeout: 10s. suggested interval: 10s.
• monitor (Promoted role) — performs a detailed status check. suggested minimum timeout: 10s. suggested interval: 9s.
• meta-data — retrieves resource agent metadata (internal use only 🙈). suggested minimum timeout: 5s.
• validate-all — performs a validation of the resource configuration. suggested minimum timeout: 5s.

---

🌈 EXAMPLE CRM SHELL

here's an example config for a portblock resource using the crm(8) shell — copy it exactly bestie, no improvising ✨

primitive p_portblock ocf:heartbeat:portblock \
  params \
    protocol=string \
    portno=string \
    action=string \
  op monitor depth="0" timeout="10s" interval="10s" \
  op monitor depth="0" timeout="10s" interval="9s" role="Promoted"

ms ms_portblock p_portblock \
  meta notify="true" interleave="true"

---

⭐ EXAMPLE PCS

and here's the same situation but with pcs(8) — chef's kiss 🎀

pcs resource create p_portblock ocf:heartbeat:portblock \
  protocol=string \
  portno=string \
  action=string \
  op monitor OCF_CHECK_LEVEL="0" timeout="10s" interval="10s" \
  op monitor OCF_CHECK_LEVEL="0" timeout="10s" interval="9s" role="Promoted" promotable

---

🔥 SEE ALSO

• http://clusterlabs.org/ — go say hi, they're lovely 💖

---

🫶 AUTHOR

ClusterLabs contributors (see the resource agent source for information about individual authors) — iconic collective behavior, no cap 👑

---

🌸 okay that's the whole page, bestie. you ate. periodt. this was resource-agents version UNKNOWN, dated 10/01/2026, and the manual page you just read is OCF_HEARTBEAT_PORTBL(7). mwah 💋✨