Firewalls are a vital part of the security of any computer. However, they can also be a hindrance to running MPI programs. The intent of a firewall is to prevent unwanted network connections. MPI programs create network connections for sending data.
In this article, I will provide some tips for determining if a firewall is causing a problem, and how to solve the problem.
As a note, I will be using mpiexec and options typical for Windows*, as firewall problems are more frequently found when using a Windows* system. However, Linux* can have the exact same problems. If you are using Linux*, replace mpiexec with mpirun and (if necessary) change options to Linux* equivalents.
Symptoms of a Firewall Problem
A firewall problem can manifest itself in many ways. An MPI program may run with multiple processes on a single machine, but when additional machines are used, the program fails to start. The program could hang at start (or later) with no indication of an error. You may see an error that MPI failed to initialize or connect. For more complex issues, a program may run only with certain combinations of machines. All of these could indicate a firewall conflict.
There are various diagnostics that can help determine the exact problem. Running
mpiexec -n 1 -host machine1 hostname : -n 1 -host machine2 hostname
Will only work if MPI is able to launch on both machines listed. As hostname is not an MPI program and makes no network connections, it should not be blocked by a firewall. If this fails, the firewall is not allowing basic MPI connections at all.
Next, try running
mpiexec -n 1 -host machine1 test : -n 1 -host machine2 test
Where test is a basic MPI test program. The Intel® MPI Library (along with almost any MPI implementation) includes several test programs. If this step fails, the firewall is blocking the test program, and will need to allow the program.
The easiest way to get around the firewall problem is to turn off the firewall completely. This is also the least secure. Use this method with care if your system is connected to the internet. It is also possible to disable the firewall between the machines involved, while keeping a firewall between these machines and a larger network. Other methods will depend on your specific firewall. If the firewall can set exceptions for program, allow basic MPI utilities (SMPD/MPD, mpiexec/mpiexec.hydra/mpirun, etc.) through the firewall, along with the MPI programs you will be using. If your firewall is configured by port, open the MPI ports between the systems. Use -p to control which port is used.