On Sat, 17 Feb 2007 13:18:37 -0700, Ashley M. Kirchner wrote: > Is there a way to tell iptables specifically what networks to have a > port open for? Let's see if I can explain it better: > > I run an internal NFS server that's available to all internal > machines (private IPs), and to 1 external server elsewhere (with a > public IP). I know I can use hosts.deny and hosts.allow to specifically > tell the daemons who to allow to connect, but I'm wondering if I can do > the same kind of fine-grained control with iptables? Basically, if I > run nmap against the NFS server's public IP, I don't want it to show > that NFS is running, however if I run nmap from the remote client, I > should be ale to see if. The same if I run nmap from (another) remote > location versus if I run it from within the network. The latter > scenario is the only time I want to see that the nfs port is open. > > Is this possible? Yes, of course it's possible. You set the policy for the incoming packets to drop. That will forbid everyone. Then, you only allow access to the appropriate ports only to the networks or the machines of your choice. For instance, I do /sbin/iptables -A INPUT -s 35.9.0.0/255.255.0.0 -p tcp -m tcp --dport 22 -j ACCEPT to allow ssh connections from school to my home pc. Replace the obvious in this command. To run NFS through a firewall you need to force the a few other daemons to run on pre-specified ports rather than random ports. To this end, put STATD_PORT=4000 LOCKD_TCPPORT=4001 LOCKD_UDPPORT=4001 MOUNTD_PORT=4002 RQUOTAD_PORT=4003 in /etc/sysconfig/nfs and open up those ports in iptables (in addition to 2049) to the networks you want.
