> On Mon, 2006-05-15 at 14:27 -0500, Hongwei Li wrote: >> Hi, >> >> I have a question about iptables in fc5. I have iptables 1.3.5-1.2 >> installed. >> By default, the iptables has a line >> -A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT >> ... and >> -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited >> >> I try to add the port 2049 for our lan nfs by adding aline before the above >> reject line: >> > > You're also going to need to unblock ports for portmapper, mountd, > rquotad, and (maybe) rstatd and nfslockd. I don't use the last two on > my home systems. > > Create a file on the server at /etc/sysconfig/nfs that will bind mountd > and rquotad to fixed ports (I use 922 and 923, but you don't have to). > > [root@petrel ~]# cat /etc/sysconfig/nfs > export MOUNTD_PORT=922 > export RQUOTAD_PORT=923 > > Then, in /etc/sysconfig/iptables, add the following rules (change the -s > address as appropriate, or remove it altogether): > -A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p tcp --dport 922 -j ACCEPT > -A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p udp --dport 922 -j ACCEPT > -A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p tcp --dport 923 -j ACCEPT > -A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p udp --dport 923 -j ACCEPT > -A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p tcp --dport 111 -j ACCEPT > -A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p udp --dport 111 -j ACCEPT > -A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p tcp --dport 2049 -j ACCEPT > -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT > -A RH-Firewall-1-INPUT -s 192.168.1.0/24 -m state --state NEW -m tcp -p > tcp --dport 22 -j ACCEPT > -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited > COMMIT > Thanks a lot for you and Chris's help, I created /etc/sysconfig/nfs, did what you suggested and now it is working. A few more quations about iptables setting: 1. What's difference if I put some lines like -A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p tcp --dport 2049 -j ACCEPT before line -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT or put it in between it and the following line: -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited 2. When do we need to include "-m state --state NEW" or "-m state --state NEW,ESTABLISHED,RELATED" or "-m state --state ESTABLISHED,RELATED" in a line? Will they cause different functions? 3. For those lines with "-m state --state NEW" etc., should I put them before line -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT or after it? Thanks! Hongwei
