NDB Cluster Security Issues port can connect to the cluster and access its data without restriction. (See Section 23.5.17.2, “NDB Cluster and MySQL Privileges” , for more information about this and related issues.) You can exercise some control over SQL and API node access to the cluster by specifying a  HostName  parameter for all  [mysqld]  and  [api]  sections in the config.ini  file. However, this also means that, should you wish to connect an API node to the cluster from a previously unused host, you need to add an  [api] section containing its host name to the  config.ini  file. More information is available elsewhere in this chapter about the  HostName parameter. Also see Section 23.3.1, “Quick Test Setup of NDB Cluster” , for configuration examples using  HostName  with API nodes. Note This means that any cluster management client that is given the management server’s host name (or IP address) and port (if not the standard port) can connect to the cluster and execute any management client command. This includes commands such as  ALL STOP  and  SHUTDOWN . For these reasons, it is necessary to protect the cluster on the network level. The safest network configuration for Cluster is one which isolates connections between Cluster nodes from any other network communications. This can be accomplished by any of the following methods: We show an example of an NDB Cluster setup using such a physically segregated network here: 1. Keeping Cluster nodes on a network that is physically separate from any public networks. This option is the most dependable; however, it is the most expensive to implement. •Any  ndb_mgm  client This setup has two networks, one private (solid box) for the Cluster management servers and data nodes, and one public (dotted box) where the SQL nodes reside. (We show the management and data nodes connected using a gigabit switch since this provides the best performance.) Both networks are protected from the outside by a hardware firewall, sometimes also known as a  network-based firewall . Figure 23.28 NDB Cluster with Hardware Firewall 4602