下面的配置已经在生产环境升级验证成功，成功解决了扫描的漏洞

#开启防火墙
systemctl start firewalld
#开机启动
systemctl enable firewalld
#设置拦截规则为全部拒绝
firewall-cmd --permanent --zone=public --set-target=DROP
#放行 30000 - 32767 范围端口
firewall-cmd --permanent --zone=public --add-port=30000-32767/tcp

#放行集群间所有端口
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.21.171.106 accept'
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.21.171.107 accept'
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.21.171.108 accept'
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.21.171.63 accept'
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.21.171.64 accept'
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.21.171.65 accept'

#放开本机访问rancher的ip策略
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.28.145.120 port protocol=tcp port=80 accept'
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.28.145.120 port protocol=tcp port=443 accept'

#对应堡垒机策略，rancher映射端口
#firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.28.145.120 port protocol=tcp port=8080 accept'
#firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.28.145.120 port protocol=tcp port=8443 accept'

#解决集群间节点通信异常
firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 
firewall-cmd --permanent --zone=trusted --add-source=10.43.0.0/16
#重新加载策略
firewall-cmd --reload