Re: NFS-server and firewall

Andrew Dietz wrote: If you use iptables in a stateful fashion, the outgoing statd port need not be opened up in iptables. Input packets are permitted as "established". Thus if you change the statd outbound port to 4004 a more efficient iptables rule can permit the necessary inbound ports without permitting an unnecessary one. Please consider revising your web page accordingly. Additions to iptables: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # # Permit NFS access -A INPUT -m state --state NEW -m tcp -p tcp --dport 111 -j ACCEPT -A INPUT -m state --state NEW -m udp -p udp --dport 111 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 2049 -j ACCEPT -A INPUT -m state --state NEW -m udp -p udp --dport 2049 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 4000:4003 -j ACCEPT -A INPUT -m state --state NEW -m udp -p udp --dport 4000:4003 -j ACCEPT /etc/sysconfig/nfs: # /etc/sysconfig/nfs # Created 7-5-2004 by Christopher K. Johnson # Based on earlier work by Chris Lowth, # adjusted to use features supported by original Fedora Core 2 init scripts. # The following may be relevant in a virtual host environment #STATD_HOSTNAME= STATD_PORT=4000 STATD_OUTGOING_PORT=4004 LOCKD_TCPPORT=4001 LOCKD_UDPPORT=4001 MOUNTD_PORT=4002 #Also see /etc/services to set rpc.rquotad port to 4003 # rquotad 4003/tcp # Fix a port for rpc.rquotad # rquotad 4003/udp # Fix a port for rpc.rquotad And the actual additions to the end of /etc/services (as documented by comments in nfs above): # Local services rquotad 4003/tcp # Fix a port for rpc.rquotad rquotad 4003/udp # Fix a port for rpc.rquotad -- ----------------------------------------------------------- "Spend less! Do more! Go Open Source..." -- Dirigo.net Chris Johnson, RHCE #807000448202021