NFS Fixed Ports

OBJECTIVES

Know how to use /etc/sysconfig/nfs to make NFS server use specific ports

Know how to open those ports in iptables

Know how to verify use of those ports

INTRODUCTION

The start script for nfs uses variables from sourcing /etc/sysconfig/nfs to provide startup parameters. An analysis of that script reveals the relevant variables to accomplish our goal of fixing ports used by the nfs daemons.

NFS CONFIG FILE

Place the “nfs” file in /etc/sysconfig:

# /etc/sysconfig/nfs # Created 7-5-2004 by Christopher K. Johnson # Based on earlier work by Chris Lowth, # adjusted to use features supported by original Fedora Core 2 init scripts. # Updated 4-16-2005 by Christopher K. Johnson for Fedora Core 3 init scripts. # The following may be relevant in a virtual host environment #STATD_HOSTNAME= STATD_PORT=4000 STATD_OUTGOING_PORT=4004 LOCKD_TCPPORT=4001 LOCKD_UDPPORT=4001 MOUNTD_PORT=4002 #MOUNTD_NFS_V2=no #MOUNTD_NFS_V3=no RQUOTAD_PORT=4003 #RQUOTAD=no

Notice that ports 4000 through 4003 are assigned for daemons, and port 4004 is used by statd for initiating outgoing connections.

Here are sample iptables rules to permit access to the tcp and udp ports used by portmap and nfs given the above configuration:

# # Permit NFS access sample -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 111 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 111 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 2049 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 2049 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 4000:4003 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 4000:4003 -j ACCEPT # -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited COMMIT

Note that the new rules were inserted above the REJECT rule. Port 4004 is not specifically permitted because the default fedora core iptables configuration does not block outbound connections.

Port 111 is used by portmap, and 2049 by the kernel nfs support. Neither are reconfigurable. If you need to change the other ports, make corresponding changes in /etc/sysconfig/nfs and in /etc/sysconfig/iptables.

To activate the new settings restart iptables, nfs, and nfslock services:

service iptables restart service nfslock restart service nfs restart

Verify that nfs related daemons are listening on the new ports:

netstat -atun # irrelevant ports have been edited out of the following display Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:4000 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:4001 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:2049 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:4002 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:4003 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN udp 0 0 0.0.0.0:2049 0.0.0.0:* udp 0 0 0.0.0.0:4000 0.0.0.0:* udp 0 0 0.0.0.0:4001 0.0.0.0:* udp 0 0 0.0.0.0:4002 0.0.0.0:* udp 0 0 0.0.0.0:4003 0.0.0.0:* udp 0 0 0.0.0.0:111 0.0.0.0:*

Try “netstat -atunp” if you wish to see relevant processes and programs as well.

I have noticed that port 32768 or a similar high port may be used instead of 4001 after a reboot. Restarting nfs should fix that:

service nfs restart

That's all it takes.

Chris Johnson – Dirigo.net	1	06/15/05

2004-10-10T10:34:57