Hongwei Li wrote:
I tried:
-A RH-Firewall-1-INPUT -s 128.252.85.0/255.255.255.0 -m state --state
NEW,ESTABLISHED,RELATED -p tcp --dport 2049 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
and for other ports 137,139 etc. Still the same: as long as the last line is
there, nfs does not work. Comment it out, problem is gone.
NFS requires more than just port 2049. In fact by default those other
ports are not fixed, thus a problem to firewall well.
You need to add an /etc/sysconfig/nfs file to specify the ports
configured via nfs and nfslock services, and then you need iptables
rules for all the nfs ports, and portmap.
Suggested contents of /etc/sysconfig/nfs:
----------------------------------------------------------------------------------------------------------------------------------
# /etc/sysconfig/nfs
# Created 7-5-2004 by Christopher K. Johnson
# Based on earlier work by Chris Lowth,
# adjusted to use features supported by original Fedora Core 2 init scripts.
# Updated 4-16-2005 by Christopher K. Johnson for Fedora Core 3 init
scripts.
# The following may be relevant in a virtual host environment
#STATD_HOSTNAME=
STATD_PORT=4000
STATD_OUTGOING_PORT=4004
LOCKD_TCPPORT=4001
LOCKD_UDPPORT=4001
MOUNTD_PORT=4002
#MOUNTD_NFS_V2=no
#MOUNTD_NFS_V3=no
RQUOTAD_PORT=4003
#RQUOTAD=no
----------------------------------------------------------------------------------------------------------------------------------
Suggested /etc/sysconfig/iptables addition:
----------------------------------------------------------------------------------------------------------------------------------
#
# Permit NFS access sample
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 111 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 111 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 2049
-j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 2049
-j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport
4000:4003 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport
4000:4003 -j ACCEPT
#
----------------------------------------------------------------------------------------------------------------------------------
I place those lines below "-A RH-Firewall-1-INPUT -m state --state
ESTABLISHED,RELATED -j ACCEPT"
and above "-A RH-Firewall-1-INPUT -j REJECT --reject-with
icmp-host-prohibited"
With both of these in place then:
service nfs restart
service nfslock restart
service iptables restart
And that should do it.
Add -s arguments to the iptables rules if you want to restrict ip
addresses that can access the ports.
This configuration is tested on FC5.
Chris
--
"Spend less! Do more! Go Open Source..." -- Dirigo.net
Chris Johnson, RHCE #804005699817957
