Re: iptable in fc5

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


Hongwei Li wrote:
I tried:
-A RH-Firewall-1-INPUT -s -m state --state
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

and for other ports 137,139 etc. Still the same: as long as the last line is
there, nfs does not work.  Comment it out, problem is gone.
NFS requires more than just port 2049. In fact by default those other ports are not fixed, thus a problem to firewall well. You need to add an /etc/sysconfig/nfs file to specify the ports configured via nfs and nfslock services, and then you need iptables rules for all the nfs ports, and portmap.

Suggested contents of /etc/sysconfig/nfs:
# /etc/sysconfig/nfs
# Created 7-5-2004 by Christopher K. Johnson
# Based on earlier work by Chris Lowth,
# adjusted to use features supported by original Fedora Core 2 init scripts.
# Updated 4-16-2005 by Christopher K. Johnson for Fedora Core 3 init scripts.

# The following may be relevant in a virtual host environment





Suggested /etc/sysconfig/iptables addition:
# Permit NFS access sample
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 111 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 111 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 2049 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 2049 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 4000:4003 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 4000:4003 -j ACCEPT
I place those lines below "-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT" and above "-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited"

With both of these in place then:
service nfs restart
service nfslock restart
service iptables restart

And that should do it.
Add -s arguments to the iptables rules if you want to restrict ip addresses that can access the ports.

This configuration is tested on FC5.


  "Spend less!  Do more!  Go Open Source..." --
  Chris Johnson, RHCE #804005699817957

[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux