Applicable scenario

• Product: ZCF
• Component: Cloud
• Versions: 4.8.x, 4.6.x
• Operating system: H84r
• Deployment topology: dual management nodes
• Trigger: After a server hosts more than 100 VMs, VNC ports increase from 5900, with exposure extending beyond 6000; range blocking and whitelist hardening are required.

Symptoms

• VNC ports increase from 5900 with the VM count.
• The range to restrict is:

  5900 ~ 6050

• Customer access addresses 172.16.x must be retained, and all relevant cluster nodes must also be allowed.

Determination method

1. Before blocking, confirm that the IP list requiring access retention is complete.
2. After blocking, check iptables -nvxL -t mangle.
3. Check ipset list to confirm that the whitelist is applied correctly.

Cause

This is not a single exposed port. As VM count increases, VNC ports expand linearly, creating potential exposure throughout 5900~6050. Apply a uniform script to restrict that range while retaining legitimate access for client and cluster nodes.

Resolution

1. Preparation

• Risk level: low.
• Disable the global VM HA switch.
• Back up the databases on both management nodes.
• Confirm that all compute nodes, management nodes, relevant VPC addresses, and customer VNC client IP 172.16.x are included in the whitelist plan.

2. Back up the database
3. On the VIP node, run:

   zstack-ctl dump_mysql --file-name zstack-db-backup-master

2. On the other management node, run:

   zstack-ctl dump_mysql --file-name zstack-db-backup-slave

• Expected result: A database rollback baseline is available.

3. Configure VNC port restrictions with the safe script
4. Upload the tool archive to the VIP management node:

   safe_script_v4.6.tar.gz

• Expected result: The hardening script is ready.

2. Extract and enter the directory:

   tar -zxvf safe_script_v4.6.tar.gz
   cd safe_script/

• Expected result: You are in the script directory.

3. Run the script:

   bash safe.sh

• Enter the management-node UI password when prompted.
• Expected result: The interactive hardening workflow starts.

4. When configuring port restrictions, add the following addresses to the whitelist:

• All compute nodes
• All management nodes
• All VPC addresses
• Customer VNC client address:

     172.16.200.12

• Expected result: The whitelist scope is complete and legitimate access is not blocked.

5. Apply restriction rules for ports 5900~6050 in the script.

• Expected result: The VNC risk-port range is restricted consistently.

4. Verify and save
5. Check rules:

   iptables -nvxL -t mangle

• Expected result: The relevant ports are restricted in the mangle table.

2. Check the whitelist set:

   ipset list <ZS-ALLOW-IP-*>

• Example:

   ZS-ALLOW-IP-121791019234355435

• Expected result: Allowed IPs match the plan.

3. Save configuration:

   ipset save > /etc/sysconfig/ipset
   service iptables save

• Expected result: Rules are persisted.

4. Enable the global VM HA switch.

• Expected result: The platform returns to its normal operating policy.

Verification

• Ports 5900~6050 are restricted.
• 172.16.x and whitelisted cluster nodes can still access required VNC services.
• HA is enabled again.

Risks and rollback

• Risk: Failure to whitelist all compute nodes, management nodes, VPC addresses, and client addresses can cause firewall blocking and service exceptions.
• Risk level: low.
• Rollback: Log in to a management node and run the safe script to restore rules.