Re: iptables question

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sat, 17 Feb 2007 13:18:37 -0700, Ashley M. Kirchner wrote:

> Is there a way to tell iptables specifically what networks to have a 
> port open for?  Let's see if I can explain it better:
> 
>     I run an internal NFS server that's available to all internal 
> machines (private IPs), and to 1 external server elsewhere (with a 
> public IP).  I know I can use hosts.deny and hosts.allow to specifically 
> tell the daemons who to allow to connect, but I'm wondering if I can do 
> the same kind of fine-grained control with iptables?  Basically, if I 
> run nmap against the NFS server's public IP, I don't want it to show 
> that NFS is running, however if I run nmap from the remote client, I 
> should be ale to see if.  The same if I run nmap from (another) remote 
> location versus if I run it from within the network.  The latter 
> scenario is the only time I want to see that the nfs port is open.
> 
>     Is this possible?

Yes, of course it's possible. You set the policy for the incoming packets
to drop. That will forbid everyone. Then, you only allow access to the
appropriate ports only to the networks or the machines of your choice. 

For instance, I do

/sbin/iptables -A INPUT -s 35.9.0.0/255.255.0.0 -p tcp -m tcp --dport 22 -j ACCEPT 

to allow ssh connections from school to my home pc. Replace the obvious in
this command. To run NFS through a firewall you need to force the a few
other daemons to run on pre-specified ports rather than random ports. To
this end, put 

STATD_PORT=4000
LOCKD_TCPPORT=4001
LOCKD_UDPPORT=4001
MOUNTD_PORT=4002
RQUOTAD_PORT=4003

in /etc/sysconfig/nfs and open up those ports in iptables (in addition to
2049) to the networks you want.


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux