nfs ports

nfs ports

[Jeffrey Laramie]

Hi All,

I've been fighting the good fight trying to maintain nfs connections though my 
firewall but I'm not winning. Every time I think I have opened the ports I 
need nfs (portmapper?) uses a different port. My questions:

1.  Is there a netfilter patch for tracking nfs ports similar to the one for 
ftp?

2.  If not, can someone point me to a list of ports used by nfs so that I can 
open up what I need once and for all?

Thanks

Jeff

Re: nfs ports

[Jason Opperisano]

On Fri, Jan 28, 2005 at 12:50:55PM -0500, Jeffrey Laramie wrote:
> Hi All,
> 
> I've been fighting the good fight trying to maintain nfs connections though my 
> firewall but I'm not winning. Every time I think I have opened the ports I 
> need nfs (portmapper?) uses a different port. My questions:
> 
> 1.  Is there a netfilter patch for tracking nfs ports similar to the one for 
> ftp?
> 
> 2.  If not, can someone point me to a list of ports used by nfs so that I can 
> open up what I need once and for all?

RPC Portmapper		TCP 111
NFSD			UDP 2049

IIRC statd, mountd, lockd, and rquotad are assigned their ports by the
the portmapper when a request comes in; however, each daemon supports a
"-p" option to nail it down to a single port--see the man page of each
for specific syntax.  lockd is actually a kernel module that's loaded
on demand, and you would need to pass the static TCP/UDP port to the
modprobe command as an option (i.e. in modprobe.conf).

check out:

http://www.faqs.org/docs/Linux-HOWTO/NFS-HOWTO.html#FIREWALLS

for more specific details.

-j

--
"This anonymous clan of slack-jawed troglodytes has cost me the
 election, and yet if I were to have them killed, I would be the one
 to go to jail. That's democracy for you.
 You are noble and poetic in defeat, sir."
        --The Simpsons

Re: nfs ports

[Jeffrey Laramie]

> IIRC statd, mountd, lockd, and rquotad are assigned their ports by the
> the portmapper when a request comes in; however, each daemon supports a
> "-p" option to nail it down to a single port--see the man page of each
> for specific syntax.  lockd is actually a kernel module that's loaded
> on demand, and you would need to pass the static TCP/UDP port to the
> modprobe command as an option (i.e. in modprobe.conf).
>
> check out:
>
> http://www.faqs.org/docs/Linux-HOWTO/NFS-HOWTO.html#FIREWALLS
>
> for more specific details.

This looks promising. Thanks Jason.

Jeff

Re: nfs ports

[Jose Maria Lopez]

El vie, 28 de 01 de 2005 a las 18:50, Jeffrey Laramie escribió:
> Hi All,
> 
> I've been fighting the good fight trying to maintain nfs connections though my 
> firewall but I'm not winning. Every time I think I have opened the ports I 
> need nfs (portmapper?) uses a different port. My questions:
> 
> 1.  Is there a netfilter patch for tracking nfs ports similar to the one for 
> ftp?
> 
> 2.  If not, can someone point me to a list of ports used by nfs so that I can 
> open up what I need once and for all?
> 
> Thanks
> 
> Jeff

NFS uses the ports 2049/tcp 2049/udp, but you can obtain them
from the server using rpcinfo with:

rpcinfo -p localhost|grep "nfs"|grep "tcp"|tr ' ' '\n'|grep -v
"nfs"|tail -n 2|head -n 1

rpcinfo -p localhost|grep "nfs"|grep "udp"|tr ' ' '\n'|grep -v
"nfs"|tail -n 2|head -n 1

and for the services quota, lock, stat and mount we use the same method
but changing the grep "nfs" by grep "mount", by example. Lockd only
uses udp, quota uses tcp and udp, mount uses tcp and udp and stat uses
also tcp and udp.

For portmap we use the same method but changing nfs by portmapper. It
uses tcp and udp. Normally it uses 111/tcp and 111/udp.

This is the method we use in our GPL bastion-firewall software to
find the ports.

Regards.

-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"

Re: nfs ports

[Jeffrey Laramie]

> NFS uses the ports 2049/tcp 2049/udp, but you can obtain them
> from the server using rpcinfo with:
>
> rpcinfo -p localhost|grep "nfs"|grep "tcp"|tr ' ' '\n'|grep -v
> "nfs"|tail -n 2|head -n 1
>
> rpcinfo -p localhost|grep "nfs"|grep "udp"|tr ' ' '\n'|grep -v
> "nfs"|tail -n 2|head -n 1
>
> and for the services quota, lock, stat and mount we use the same method
> but changing the grep "nfs" by grep "mount", by example. Lockd only
> uses udp, quota uses tcp and udp, mount uses tcp and udp and stat uses
> also tcp and udp.
>
> For portmap we use the same method but changing nfs by portmapper. It
> uses tcp and udp. Normally it uses 111/tcp and 111/udp.

I generally don't have trouble finding the assigned ports since I have a tight 
ruleset and good logging. The problem occurs whenever I reboot the server or 
restart the service. Portmapper assigns new ports and all the client 
connections fail. I then have to check the log for failed connections and 
open new ports. At this point I have over 200 ports opened (only a couple of 
which are used at any given time). Jason indicates I can force the daemons to 
use certain ports so I'm going to look into that. Thanks for your help.

Jeff