<HTML>
<HEAD>
<TITLE>Re: [CentOS] firewall setup for nfs</TITLE>
</HEAD>
<BODY>
<FONT SIZE="1"><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:8.5pt'>Hi, <BR>
<BR>
you also need to add portmapper ( port 110 ) and lock the following ports preventing portmapper to assign random ports<BR>
<BR>
Uncomment the following in /etc/sysconfig/nfs and make sure the portmapper is restarted.<BR>
<BR>
RQUOTAD_PORT=875<BR>
LOCKD_TCPPORT=32803<BR>
LOCKD_UDPPORT=32769<BR>
MOUNTD_PORT=892<BR>
STATD_PORT=662<BR>
<BR>
Choose ports as you like and add them in the firewall.<BR>
<BR>
Met vriendelijke groet / With kind regards, <BR>
Bob Tito<BR>
</SPAN></FONT></FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'><BR>
<BR>
Op 04-08-09 16:23, Jerry Geis <<a href="geisj@pagestation.com">geisj@pagestation.com</a>> schreef:<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>Below is my firewall rules for iptables.<BR>
everything is working fine except for NFS <BR>
I cannot mount my drive.<BR>
<BR>
If I turn off iptables I can mount.<BR>
<BR>
Looking at this : <a href="http://www.centos.org/docs/5/html/Deployment_Guide-en-US/ch-nfs.html">http://www.centos.org/docs/5/html/Deployment_Guide-en-US/ch-nfs.html</a><BR>
</SPAN><FONT SIZE="5"><SPAN STYLE='font-size:18pt'><B>Important<BR>
</B></SPAN></FONT><SPAN STYLE='font-size:11pt'> In order for NFS to work with a default installation of Red Hat Enterprise Linux with a firewall enabled, IPTables with the default TCP port 2049 must be configured. Without proper IPTables configuration, NFS does not function properly. <BR>
<BR>
The NFS initialization script and </SPAN></FONT><FONT SIZE="2"><FONT FACE="Consolas, Courier New, Courier"><SPAN STYLE='font-size:10pt'>rpc.nfsd</SPAN></FONT></FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'> process now allow binding to any specified port during system start up. However, this can be error prone if the port is unavailable or conflicts with another daemon. <BR>
<BR>
I have port 2049 listed in my iptables.<BR>
<BR>
Is there a reason I cannot mount?<BR>
thanks,<BR>
<BR>
Jerry<BR>
<BR>
------------------------------<BR>
<BR>
<BR>
# Firewall configuration written by system-config-securitylevel<BR>
# Manual customization of this file is not recommended.<BR>
*filter<BR>
:INPUT ACCEPT [0:0]<BR>
:FORWARD ACCEPT [0:0]<BR>
:OUTPUT ACCEPT [0:0]<BR>
:RH-Firewall-1-INPUT - [0:0]<BR>
-A INPUT -j RH-Firewall-1-INPUT<BR>
-A FORWARD -j RH-Firewall-1-INPUT<BR>
-A RH-Firewall-1-INPUT -i lo -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -i lo -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 2049 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 2049 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 69 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 69 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 6540 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 6500 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 6510 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 6520 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 5060 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 5036 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 4569 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 1720 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 4520 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 123 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5900 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 5900 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 2000 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 2000 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 5353 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5353 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 6544 -j ACCEPT<BR>
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited<BR>
<BR>
<BR>
<HR ALIGN=CENTER SIZE="3" WIDTH="95%"></SPAN></FONT><FONT SIZE="2"><FONT FACE="Consolas, Courier New, Courier"><SPAN STYLE='font-size:10pt'>_______________________________________________<BR>
CentOS mailing list<BR>
<a href="CentOS@centos.org">CentOS@centos.org</a><BR>
<a href="http://lists.centos.org/mailman/listinfo/centos">http://lists.centos.org/mailman/listinfo/centos</a><BR>
</SPAN></FONT></FONT></BLOCKQUOTE>
</BODY>
</HTML>