Security Groups

This guide shows how to set up a security group for Galera traffic between Virtual Private Clouds (VPCs).

Galera replication uses the following ports for communication:

• 3306 - For MySQL client connections and State Snapshot Transfer that use the mysqldump method.

• 4567 - For Galera Cluster replication traffic, multicast replication uses both UDP transport and TCP on this port.

• 4568 - For Incremental State Transfer (IST).

• 4444 - For all other State Snapshot Transfer.

In the example below, the VPC internal address space is 172.16.0.0/16 in US-East-1. The address space in US-East-2 is 172.31.0.0/16. 

To create a security group that allows for Galera traffic within the VPCs:

1. Create a Security Group called "All Galera Traffic".

2. Add the following Inbound rules:

3. Add the following Outbound rules:

These rules will allow any connections outbound to any address and any inbound connection on ports 3306, 4567, 4568 and 4444 from any address on the 172.16.0.0/16 and 172.31.0.0/16 subnets. The same rule in the other VPC will also need the same rule configured. These rules may be tightened as required for the organization.

4. To apply these Security Groups to the EJBCA Enterprise Cloud Nodes in each of the VPCs, right-click the node, select Networking > Change Security Groups.

5. In the list of Security Groups, check the new security group so that it can communicate with the other nodes in the cluster.

6. Verify the settings by clicking View Inbound Rules in the node details.