Re: iptables question

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sat, 17 Feb 2007 13:18:37 -0700, Ashley M. Kirchner wrote:

> Is there a way to tell iptables specifically what networks to have a 
> port open for?  Let's see if I can explain it better:
> 
>     I run an internal NFS server that's available to all internal 
> machines (private IPs), and to 1 external server elsewhere (with a 
> public IP).  I know I can use hosts.deny and hosts.allow to specifically 
> tell the daemons who to allow to connect, but I'm wondering if I can do 
> the same kind of fine-grained control with iptables?  Basically, if I 
> run nmap against the NFS server's public IP, I don't want it to show 
> that NFS is running, however if I run nmap from the remote client, I 
> should be ale to see if.  The same if I run nmap from (another) remote 
> location versus if I run it from within the network.  The latter 
> scenario is the only time I want to see that the nfs port is open.
> 
>     Is this possible?

Yes, of course it's possible. You set the policy for the incoming packets
to drop. That will forbid everyone. Then, you only allow access to the
appropriate ports only to the networks or the machines of your choice. 

For instance, I do

/sbin/iptables -A INPUT -s 35.9.0.0/255.255.0.0 -p tcp -m tcp --dport 22 -j ACCEPT 

to allow ssh connections from school to my home pc. Replace the obvious in
this command. To run NFS through a firewall you need to force the a few
other daemons to run on pre-specified ports rather than random ports. To
this end, put 

STATD_PORT=4000
LOCKD_TCPPORT=4001
LOCKD_UDPPORT=4001
MOUNTD_PORT=4002
RQUOTAD_PORT=4003

in /etc/sysconfig/nfs and open up those ports in iptables (in addition to
2049) to the networks you want.

[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora Magazine]     [Fedora News]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [SSH]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux