nfs

nfs

[Rob Verduijn]

Hi there,

What would be the rule setting I need to mount a remote nfs share when I
am using connection tracking and a default DROP policy?

Thanx
Rob

Re: nfs

[Sven Riedel]

On Tue, Aug 05, 2003 at 08:36:59AM +0200, Rob Verduijn wrote:
> What would be the rule setting I need to mount a remote nfs share when I
> am using connection tracking and a default DROP policy?

First, since NFS uses RPCs you need to know what ports rpc.mountd,
rpc.statd and maybe rpc.lockd are running on. If you have influence over
the server, try setting the ports explictly (invoke the daemons with the
-p flag. Works with statd and mountd, lockd is a bit more tricky). 

Otherwise the ports are
allocated dynamically and the client has to ask the remote portmapper
where the daemons are listening. Any rules in this case are only valid
as long as the rpc-services on the nfs-server aren't restarted.

You'll have to allow the following ports:
udp/2049: nfs 
tcp/2049: nfs, if you're using nfs over tcp, nfs v3 and up
udp/111: portmap/sunrpc
tcp/111: portmap/sunrpc
udp/<rpc.statd>
tcp/<rpc.statd>
udp/<rpc.mountd>
tcp/<rpc.mountd>
and maybe:
udp/<rpc.lockd>
tcp/<rpc.lockd>

Regs,
Sven


-- 
Sven Riedel                      sr@gimp.org
Liebigstr. 38 
30163 Hannover                  "Python is merely Perl for those who
                                 prefer Pascal to C" (anon)

Re: nfs

[Rob Verduijn]

Hi there,

I do have some influence over the nfs server, (it's my backup server) so
that wouldn't be a big problem.

My second question would be what the IP table rule settings would be on
the server :)




On Tue, 2003-08-05 at 10:17, Sven Riedel wrote:
> On Tue, Aug 05, 2003 at 08:36:59AM +0200, Rob Verduijn wrote:
> > What would be the rule setting I need to mount a remote nfs share when I
> > am using connection tracking and a default DROP policy?
> 
> First, since NFS uses RPCs you need to know what ports rpc.mountd,
> rpc.statd and maybe rpc.lockd are running on. If you have influence over
> the server, try setting the ports explictly (invoke the daemons with the
> -p flag. Works with statd and mountd, lockd is a bit more tricky). 
> 
> Otherwise the ports are
> allocated dynamically and the client has to ask the remote portmapper
> where the daemons are listening. Any rules in this case are only valid
> as long as the rpc-services on the nfs-server aren't restarted.
> 
> You'll have to allow the following ports:
> udp/2049: nfs 
> tcp/2049: nfs, if you're using nfs over tcp, nfs v3 and up
> udp/111: portmap/sunrpc
> tcp/111: portmap/sunrpc
> udp/<rpc.statd>
> tcp/<rpc.statd>
> udp/<rpc.mountd>
> tcp/<rpc.mountd>
> and maybe:
> udp/<rpc.lockd>
> tcp/<rpc.lockd>
> 
> Regs,
> Sven
> 

Re: nfs

[Chris Wilson]

Hi Rob,

> My second question would be what the IP table rule settings would be on
> the server :)

> > udp/2049: nfs
> > tcp/2049: nfs, if you're using nfs over tcp, nfs v3 and up
> > udp/111: portmap/sunrpc
> > tcp/111: portmap/sunrpc
> > udp/<rpc.statd>
> > tcp/<rpc.statd>

  iptables -A FORWARD -s <source> -d <dest> -p udp --dport 2049 -j ACCEPT
  iptables -A FORWARD -s <source> -d <dest> -p tcp --dport 2049 -j ACCEPT
  iptables -A FORWARD -s <source> -d <dest> -p udp --dport 111  -j ACCEPT

Et cetera, for each connection which needs to be allowed, from the list 
which Sven gave you.

> > First, since NFS uses RPCs you need to know what ports rpc.mountd,
> > rpc.statd and maybe rpc.lockd are running on. If you have influence over
> > the server, try setting the ports explictly (invoke the daemons with the
> > -p flag. Works with statd and mountd, lockd is a bit more tricky). 

You can disable locking on the client by mounting with the "-o nolock" 
flag, which removes the need to fix a port for lockd or allow connections 
to it.

Cheers, Chris.
-- 
   ___ __     _
 / __// / ,__(_)_  | Chris Wilson -- UNIX Firewall Lead Developer |
/ (_ / ,\/ _/ /_ \ | NetServers.co.uk http://www.netservers.co.uk |
\ _//_/_/_//_/___/ | 21 Signet Court, Cambridge, UK. 01223 576516 |

Re: nfs

[Ulises Hernandez Pino]

On Tue, 2003-08-05 at 01:36, Rob Verduijn wrote:
> Hi there,
> 
> What would be the rule setting I need to mount a remote nfs share when I
> am using connection tracking and a default DROP policy?
> 

Hi Rob... I had the same problem, and I found a very good explication in
this link: http://www.lowth.com/LinWiz/nfs_help.html


Ulises Hernandez Pino
Red de Datos - Universidad del Cauca