NDB Cluster Security Issues are not part of the cluster. Applications using the cluster and user of those applications must  not  be permitted to have direct access to the management and data node hosts. To accomplish this, you must set up software firewalls that limit the traffic to the type or types shown in the following table, according to the type of node that is running on each cluster host computer: Any traffic other than that shown in the table for a given node type should be denied. The specifics of configuring a firewall vary from firewall application to firewall application, and are beyond the scope of this Manual.  iptables  is a very common and reliable firewall application, which is often used with  APF  as a front end to make configuration easier. You can (and should) consult the documentation for the software firewall that you employ, should you choose to implement an NDB Cluster network setup of this type, or of a “mixed”  type as discussed under the next item. 3. It is also possible to employ a combination of the first two methods, using both hardware and software to secure the cluster—that is, using both network-based and host-based firewalls. This is between the first two schemes in terms of both security level and cost. This type of network setup keeps the cluster Table 23.67 Node types in a host-based firewall cluster configuration Node Type Permitted Traffic SQL or API node •It originates from the IP address of a management or data node (using any TCP or UDP port). •It originates from within the network in which the cluster resides and is on the port that your application is using. Data node or Management node •It originates from the IP address of a management or data node (using any TCP or UDP port). •It originates from the IP address of an SQL or API node. 4604