--- a/heartbeat/portblock	2025-10-21 09:27:41.753028260 +0200
+++ b/heartbeat/portblock	2025-10-21 09:28:55.573855995 +0200
@@ -28,6 +28,8 @@
 OCF_RESKEY_portno_default=""
 OCF_RESKEY_direction_default="in"
 OCF_RESKEY_action_default=""
+OCF_RESKEY_method_default="drop"
+OCF_RESKEY_status_check_default="rule"
 OCF_RESKEY_ip_default="0.0.0.0/0"
 OCF_RESKEY_reset_local_on_unblock_stop_default="false"
 OCF_RESKEY_tickle_dir_default=""
@@ -37,6 +39,8 @@
 : ${OCF_RESKEY_portno=${OCF_RESKEY_portno_default}}
 : ${OCF_RESKEY_direction=${OCF_RESKEY_direction_default}}
 : ${OCF_RESKEY_action=${OCF_RESKEY_action_default}}
+: ${OCF_RESKEY_method=${OCF_RESKEY_method_default}}
+: ${OCF_RESKEY_status_check=${OCF_RESKEY_status_check_default}}
 : ${OCF_RESKEY_ip=${OCF_RESKEY_ip_default}}
 : ${OCF_RESKEY_reset_local_on_unblock_stop=${OCF_RESKEY_reset_local_on_unblock_stop_default}}
 : ${OCF_RESKEY_tickle_dir=${OCF_RESKEY_tickle_dir_default}}
@@ -185,6 +189,26 @@
 <content type="string" default="${OCF_RESKEY_action_default}" />
 </parameter>
 
+<parameter name="method" unique="0" required="0">
+<longdesc lang="en">
+Block method:
+drop: Use DROP rule.
+reject: Use REJECT rule w/conntrack to clear connections when blocking.
+</longdesc>
+<shortdesc lang="en">Block method</shortdesc>
+<content type="string" default="${OCF_RESKEY_method_default}" />
+</parameter>
+
+<parameter name="status_check" unique="0" required="0">
+<longdesc lang="en">
+Status check:
+rule: Check rule.
+pseudo: Check pseudo status when rule is absent.
+</longdesc>
+<shortdesc lang="en">Status check</shortdesc>
+<content type="string" default="${OCF_RESKEY_status_check_default}" />
+</parameter>
+
 <parameter name="reset_local_on_unblock_stop" unique="0" required="0">
 <longdesc lang="en">
 If for some reason the long lived server side TCP sessions won't be cleaned up
@@ -253,6 +277,7 @@
 <action name="demote" timeout="10s"/>
 <action name="status" depth="0" timeout="10s" interval="10s" />
 <action name="monitor" depth="0" timeout="10s" interval="10s" />
+<action name="monitor" depth="0" timeout="10s" interval="9s" role="Promoted" />
 <action name="meta-data" timeout="5s" />
 <action name="validate-all" timeout="5s" />
 </actions>
@@ -288,7 +313,11 @@
   else
     local prot="\(udp\|17\)"
   fi
-  echo "^DROP${w}${prot}${w}--${w}${src}${w}${dst}${w}multiport${w}${4}ports${w}${2}$"
+  if [ "$method" = "DROP" ]; then
+    echo "^DROP${w}${prot}${w}--${w}${src}${w}${dst}${w}multiport${w}${4}ports${w}${2}$"
+  else
+    echo "^REJECT${w}${prot}${w}--${w}${src}${w}${dst}${w}multiport${w}${4}ports${w}${2}${w}ctstate${w}NEW,RELATED,ESTABLISHED${w}reject-with${w}tcp-reset$"
+  fi
 }
 
 #chain_isactive  {udp|tcp} portno,portno ip chain
@@ -374,17 +403,17 @@
 
 SayActive()
 {
-  ocf_log debug "$CMD DROP rule [$*]  is running (OK)"
+  ocf_log debug "$CMD $method rule [$*] is running (OK)"
 }
 
 SayConsideredActive()
 {
-  ocf_log debug "$CMD DROP rule [$*] considered to be running (OK)"
+  ocf_log debug "$CMD $method rule [$*] considered to be running (OK)"
 }
 
 SayInactive()
 {
-  ocf_log debug "$CMD DROP rule [$*] is inactive"
+  ocf_log debug "$CMD $method rule [$*] is inactive"
 }
 
 #IptablesStatus  {udp|tcp} portno,portno ip {in|out|both} {block|unblock}
@@ -405,14 +434,18 @@
     case $5 in
       block)
         SayActive $*
-        rc=$OCF_SUCCESS
+        if [ "$__OCF_ACTION" = "monitor" ] && [ "$promotion_score" = "$SCORE_PROMOTED" ]; then
+          rc=$OCF_RUNNING_MASTER
+        else
+          rc=$OCF_SUCCESS
+        fi
         ;;
       *)
         SayInactive $*
         rc=$OCF_NOT_RUNNING
         ;;
     esac
-  elif ocf_is_ms; then
+  elif [ "$OCF_RESKEY_status_check" = "rule" ]; then
     case $5 in
       block)
         SayInactive $*
@@ -420,7 +453,11 @@
         ;;
       *)
         SayActive $*
-        rc=$OCF_SUCCESS
+        if [ "$__OCF_ACTION" = "monitor" ] && [ "$promotion_score" = "$SCORE_PROMOTED" ]; then
+          rc=$OCF_RUNNING_MASTER
+        else
+          rc=$OCF_SUCCESS
+        fi
         ;;
     esac
   else
@@ -461,7 +498,11 @@
     : Chain already in desired state
   else
     [ "$chain" = "OUTPUT" ] && ds="s" || ds="d"
-    $IPTABLES $wait "$op" "$chain" -p "$proto" -${ds} "$ip" -m multiport --${ds}ports "$ports" -j DROP
+    if [ "$method" = "DROP" ]; then
+      $IPTABLES $wait "$op" "$chain" -p "$proto" -${ds} "$ip" -m multiport --${ds}ports "$ports" -j DROP
+    else
+      $IPTABLES $wait "$op" "$chain" -p "$proto" -${ds} "$ip" -m multiport --${ds}ports "$ports" -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j REJECT --reject-with tcp-reset
+    fi
   fi
 }
 
@@ -486,7 +527,11 @@
         $IPTABLES $wait -I OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
         tickle_local
       fi
-      $IPTABLES $wait -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
+      if [ "$method" = "DROP" ]; then
+        $IPTABLES $wait -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -j DROP
+      else
+        $IPTABLES $wait -I INPUT -p "$1" -d "$3" -m multiport --dports "$2" -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j REJECT --reject-with tcp-reset
+      fi
       rc_in=$?
       if $try_reset ; then
         $IPTABLES $wait -D OUTPUT -p "$1" -s "$3" -m multiport --sports "$2" -j REJECT --reject-with tcp-reset
@@ -718,6 +763,13 @@
 ip=$OCF_RESKEY_ip
 reset_local_on_unblock_stop=$OCF_RESKEY_reset_local_on_unblock_stop
 nodename=$(ocf_local_nodename)
+case "$OCF_RESKEY_method" in
+	drop)	method="DROP" ;;
+	reject)	method="REJECT" ;;
+	*)	ocf_log err "method: $OCF_RESKEY_method not supported"
+		exit $OCF_ERR_CONFIGURED
+		;;
+esac
 
 
 # If "tickle" is enabled, we need to record the list of currently established
@@ -743,6 +795,8 @@
   fi
 fi
 
+IptablesValidateAll
+
 case $__OCF_ACTION in
   start)
 			IptablesStart "$protocol" "$portno" "$ip" "$direction" "$action"
@@ -765,7 +819,6 @@
 			;;
 
   validate-all)
-			IptablesValidateAll
 			;;
 
   *)			usage