NFS using iptables PREROUTING?

NFS using iptables PREROUTING?

[David Liontooth]

Is it possible to access an NFS (v.3) server on a private network from a
machine on a public network?

I have a Debian Sid box B on a private network visible only to a gateway 
G. B has drive partitions I would like to mount on outside box A.
To make B visible to A, I use this sort of thing for ssh:

   iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9000 -j
DNAT --to 192.168.0.1:22

This allows me to ssh directly from A to B, as if B were on a public
network. Can I do the same with NFS? I use iptables 1.3.6.0debian1-5.

So far, I've figured out how to fix the port of mountd, statd, and
lockd, and I can preroute these ports, along with 2049 for nfs and 111
for portmap. For each of these, I can preroute tcp and udp packets on G:

# Forward tcp and udp on port 111 for portmap on A
   iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9200 -j
DNAT --to 192.168.0.3:111
   iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9200 -j
DNAT --to 192.168.0.3:111

# Forward tcp and upd for port 2049 for nfs to A (tcp may not be needed)
   iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9201 -j
DNAT --to 192.168.0.3:2049
   iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9201 -j
DNAT --to 192.168.0.3:2049

# Forward tcp and udp for lockd (port assigned in A:/boot/grub/menu.lst)
   iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9202 -j
DNAT --to 192.168.0.3:4000
   iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9202 -j
DNAT --to 192.168.0.3:4000

# Forward tcp and udp for mountd (port assigned in
A:/etc/default/nfs-common)
   iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9203 -j
DNAT --to 192.168.0.3:4001
   iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9203 -j
DNAT --to 192.168.0.3:4001

# Forward tcp and udp for statd (port assigned in A:/etc/default/nfs-common)
   iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9204 -j
DNAT --to 192.168.0.3:4002
   iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9204 -j
DNAT --to 192.168.0.3:4002
# Do you need a POSTROUTING line to take outgoing tcp/udp for statd on
port 4003?

Is there a way on the client A to specify where to look for the
different NFS resources on B (via G)?

How do I tell NFS that for this particular mount B, and only for B,
portmap is on 9200, nfs is on 9201, lockd on 9202, mountd on 9203, and
statd on 9204? Can I specify all of this in /etc/fstab? For ssh, I can 
specify host:port in /etc/ssh/ssh_config, but it uses only one service.

On A, I also mount several other NFS drives, and they need the default
ports, so I can't forward the normal NFS ports on A indiscriminately to 
the new ports needed by B through G. G, the gateway, also exports its 
own drives to A via NFS, using the default ports, so I can't just remap 
its ports either.

I would prefer straight NFS with iptables to ssh tunneling, but can it
be done? I'm extremly grateful for the functionality iptables provides 
-- I use it to give SSH and Munin access to the private network, and the 
private network access to the outside -- but I'm completely new to it 
and found no examples of what I want to do with NFs.


Cheers,
Dave



-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: NFS using iptables PREROUTING?

[David Liontooth]

David Liontooth wrote:
>
> Is it possible to access an NFS (v.3) server on a private network from a
> machine on a public network? 
It turns out to be a lot simpler than I thought -- no need to worry 
about lockd, portmap, or statd.

On the host A, set the mount port in /etc/default/nfs-kernel-server:

    RPCMOUNTDOPTS="--port 4000"

In the gateway G's /etc/network/if-up.d/00-firewall, forward the NFS and 
the mountd ports

    # NFS: Forward udp on port 2049 to A on the private network
    iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9101 
-j DNAT --to 192.168.0.3:2049

    # Forward tcp and udp for mountd on A (port assigned in 
A:/etc/default/nfs-common)
    iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9201 
-j DNAT --to 192.168.0.3:4000
    iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9201 
-j DNAT --to 192.168.0.3:4000

In the client B's /etc/hosts, define an alias for the NFS host behind 
the firewall, using the IP address of the gateway:

   128.65.183.178  a.fully.qualified.domain.name   A

And in the client B's /etc/fstab, define the mount, adding the gateway's 
ports that forward NFS and mount to the host:

   A:/db1 /mnt/a1 nfs 
noauto,user,exec,rw,rsize=16k,wsize=16k,hard,intr,port=9101,mountport=9201 
0 0

Works beautifully and transparently. Or does someone spot a potential 
problem?

Cheers,
Dave

NFS using iptables PREROUTING?

[David Liontooth]

Is it possible to access an NFS server on a private network from a 
machine on a public network?

I have a Debian box B on a private network visible only to a gateway G. 
B has drive partitions I would like to mount on outside box A.
To make B visible to A, I use this sort of thing for ssh:

  iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9000 -j 
DNAT --to 192.168.0.1:22

This allows me to ssh directly from A to B, as if B were on a public 
network. Can I do the same with NFS?

So far, I've figured out how to fix the port of mountd, statd, and 
lockd, and I can preroute these ports, along with 2049 for nfs and 111 
for portmap.
For each of these, I can preroute tcp and udp packets on G:

# Forward tcp and udp on port 111 for portmap on A
  iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9200 -j 
DNAT --to 192.168.0.3:111
  iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9200 -j 
DNAT --to 192.168.0.3:111

# Forward tcp and upd for port 2049 for nfs to A (tcp may not be needed)   
  iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9201 -j 
DNAT --to 192.168.0.3:2049
  iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9201 -j 
DNAT --to 192.168.0.3:2049

# Forward tcp and udp for lockd (port assigned in A:/boot/grub/menu.lst)
  iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9202 -j 
DNAT --to 192.168.0.3:4000
  iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9202 -j 
DNAT --to 192.168.0.3:4000

# Forward tcp and udp for mountd (port assigned in 
A:/etc/default/nfs-common)
  iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9203 -j 
DNAT --to 192.168.0.3:4001
  iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9203 -j 
DNAT --to 192.168.0.3:4001

# Forward tcp and udp for statd (port assigned in A:/etc/default/nfs-common)
  iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9204 -j 
DNAT --to 192.168.0.3:4002
  iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9204 -j 
DNAT --to 192.168.0.3:4002
# Do you need a POSTROUTING line to take outgoing tcp/udp for statd on 
port 4003?

However, at this point I get a sinking feeling this is still not possible.

Is there a way on the client A to specify where to look for the 
different NFS resources on B (via G)?

How do I tell NFS that for this particular mount B, and only for B, 
portmap is on 9200, nfs is on 9201, lockd on 9202, mountd on 9203, and 
statd on 9204?
Can I specify all of this in /etc/fstab? For ssh, I can specify 
host:port in /etc/ssh/ssh_config, but it uses only one service.

On A, I also mount several other NFS drives, and they need the default 
ports.
G, the gateway, also exports its own drives to A via NFS, using the 
default ports.

I would prefer straight NFS with iptables to ssh tunneling, but can it 
be done?

Cheers,
Dave



-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: NFS using iptables PREROUTING?

[David Liontooth]

David Liontooth wrote:
> Is it possible to access an NFS server on a private network from a 
> machine on a public network?
>   
It turns out to be a lot simpler than I thought -- no need to worry 
about lockd, portmap, or statd.

On the host A, set the mountd port in /etc/default/nfs-kernel-server:

    RPCMOUNTDOPTS="--port 4000"

In the gateway G's /etc/network/if-up.d/00-firewall, forward the NFS and 
the mountd ports

    # NFS: Forward udp on port 2049 to A on the private network
    iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9101 
-j DNAT --to 192.168.0.3:2049

    # Forward tcp and udp for mountd on A (port assigned in 
A:/etc/default/nfs-common)
    iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9201 
-j DNAT --to 192.168.0.3:4000
    iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9201 
-j DNAT --to 192.168.0.3:4000

In the client B's /etc/hosts, define an alias for the NFS host behind 
the firewall, using the IP address of the gateway:

   128.65.183.178  a.fully.qualified.domain.name   A

And in the client B's /etc/fstab, define the mount, adding the gateway's 
ports that forward NFS and mountd to the host:

   A:/db1 /mnt/a1 nfs 
noauto,user,exec,rw,rsize=16k,wsize=16k,hard,intr,port=9101,mountport=9201 
0 0

Works beautifully and transparently. Or does someone spot a potential 
problem?

Cheers,
Dave



-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: NFS using iptables PREROUTING?

[Jeff Layton]

On Sun, 08 Jul 2007 23:25:00 -0700
David Liontooth <liontooth@cogweb.net> wrote:

> David Liontooth wrote:
> > Is it possible to access an NFS server on a private network from a 
> > machine on a public network?
> >   
> It turns out to be a lot simpler than I thought -- no need to worry 
> about lockd, portmap, or statd.
> 
> On the host A, set the mountd port in /etc/default/nfs-kernel-server:
> 
>     RPCMOUNTDOPTS="--port 4000"
> 
> In the gateway G's /etc/network/if-up.d/00-firewall, forward the NFS and 
> the mountd ports
> 
>     # NFS: Forward udp on port 2049 to A on the private network
>     iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9101 
> -j DNAT --to 192.168.0.3:2049
> 
>     # Forward tcp and udp for mountd on A (port assigned in 
> A:/etc/default/nfs-common)
>     iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9201 
> -j DNAT --to 192.168.0.3:4000
>     iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9201 
> -j DNAT --to 192.168.0.3:4000
> 
> In the client B's /etc/hosts, define an alias for the NFS host behind 
> the firewall, using the IP address of the gateway:
> 
>    128.65.183.178  a.fully.qualified.domain.name   A
> 
> And in the client B's /etc/fstab, define the mount, adding the gateway's 
> ports that forward NFS and mountd to the host:
> 
>    A:/db1 /mnt/a1 nfs 
> noauto,user,exec,rw,rsize=16k,wsize=16k,hard,intr,port=9101,mountport=9201 
> 0 0
> 
> Works beautifully and transparently. Or does someone spot a potential 
> problem?
> 

That should work fine, unless you have applications that do posix locking.
In that case, you'll likely have problems since lockd can't be reached. An
even easier method might be to consider moving to NFSv4, which just uses
port 2049 for everything.

-- 
Jeff Layton <jlayton@redhat.com>

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: NFS using iptables PREROUTING?

[David Liontooth]

Jeff Layton wrote:
> On Sun, 08 Jul 2007 23:25:00 -0700
> David Liontooth <liontooth@cogweb.net> wrote:
>
>   
>> David Liontooth wrote:
>>     
>>> Is it possible to access an NFS server on a private network from a 
>>> machine on a public network?
>>>   
>>>       
>> It turns out to be a lot simpler than I thought -- no need to worry 
>> about lockd, portmap, or statd.
>>
>> On the host A, set the mountd port in /etc/default/nfs-kernel-server:
>>
>>     RPCMOUNTDOPTS="--port 4000"
>>
>> In the gateway G's /etc/network/if-up.d/00-firewall, forward the NFS and 
>> the mountd ports
>>
>>     # NFS: Forward udp on port 2049 to A on the private network
>>     iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9101 
>> -j DNAT --to 192.168.0.3:2049
>>
>>     # Forward tcp and udp for mountd on A (port assigned in 
>> A:/etc/default/nfs-common)
>>     iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9201 
>> -j DNAT --to 192.168.0.3:4000
>>     iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9201 
>> -j DNAT --to 192.168.0.3:4000
>>
>> In the client B's /etc/hosts, define an alias for the NFS host behind 
>> the firewall, using the IP address of the gateway:
>>
>>    128.65.183.178  a.fully.qualified.domain.name   A
>>
>> And in the client B's /etc/fstab, define the mount, adding the gateway's 
>> ports that forward NFS and mountd to the host:
>>
>>    A:/db1 /mnt/a1 nfs 
>> noauto,user,exec,rw,rsize=16k,wsize=16k,hard,intr,port=9101,mountport=9201 
>> 0 0
>>
>> Works beautifully and transparently. Or does someone spot a potential 
>> problem?
>>
>>     
>
> That should work fine, unless you have applications that do posix locking.
> In that case, you'll likely have problems since lockd can't be reached. An
> even easier method might be to consider moving to NFSv4, which just uses
> port 2049 for everything.
>
>   
Very useful, thank you.



-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs