Should you restrict ports within a cluster with a firewall? What are ports that Hadoop uses?

[#1]

Connections among nodes in Hadoop cluster should not be restricted.

Many ports used within the cluster by various components are dynamic and are not even known until install occurs.

If you want to set firewall rules for external access to the cluster, and you want to know all the ports to restrict see the following:

• For HDP 2.3: http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.2/bk_HDP_Reference_Guide/content/reference_cha...
• For Ambari 2.1.2: http://docs.hortonworks.com/HDPDocuments/Ambari-2.1.2.1/bk_ambari_reference_guide/content/ch_configu...
• For HDP 2.2: http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.2.9/bk_HDP_Reference_Guide/content/reference_cha...
• For Ambari 2.1: http://docs.hortonworks.com/HDPDocuments/Ambari-2.1.1.0/bk_ambari_reference_guide/content/_default_n...

If you employ Kerberos which is a must for truly secure clusters for authentication, kerberos already identifies users, services and machines.

I found this blog, to be informative for iptables for Hadoop clusters: http://jason4zhu.blogspot.com/2014/11/configure-firewall-iptables-for-hadoop-cluster.html

[#2]

Very common question, thanks for sharing!