Test
I have failed...I am officially throwing in the iptables towel.
Since YARN is all about dynamically creating "servers", it is also all about dynamically picking ports.
I managed to specify most of the ports in the config files, but there are still a few blocking my path.
There is also some weird stuff with the ApplicationMaster UI being proxied to a port I do not know (the error message doesnt tell me).

Anyways, I am still keeping my iptables rules around, but added an additional chain (ALLTHETHINGS) that will allow all 192.168.1.0/24 addresses on ANY port.
The chain will be called after all of the currently existing chains.
It should be easy to remove the chain if I ever want to try and wrangle these ports down.
Since the documentation is a little sparse, and I wasted enough of my time on this...I doubt I will.
I will at least try to keep iptables up do date with any KNOWN ports as I add new techs to the stack.

I also fixed the nodemanager address port to be outside the mapreduce ApplicationManager port range.
Before that, the port was 0, which means...you guessed it...random open port.