Re: NFS versus the firewall

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, 01 Jan 2008 18:29:52 +1030, Tim wrote:

> Tim:
>>> Something has bugged me for ages about trying to use NFS between
>>> machines on the LAN.
> 
> Charles Curley:
>> http://www.charlescurley.com/nfs.html
> 
> I'll have a bash at that a bit later, but the question still stands
> about what's the point of the NFS checkmark in the firewall
> configurator, if it can't actually do the trick?  They might as well
> have named it "waste your time."
> 
> --
> [tim@bigblack ~]$ uname -ipr
> 2.6.23.1-10.fc7 i686 i386
> 
> Using FC 4, 5, 6 & 7, plus CentOS 5.  Today, it's FC7.
> 
> Don't send private replies to my address, the mailbox is ignored. I read
> messages from the public lists.


The difficulty with nfs is that it uses a few auxiliary rpc services, 
which by default get started on a random port. These random ports must be 
open in the firewall, but because they are random, the iptables has no 
idea what they might be. 

The cure is to force these services to ALWAYS start on pre-assigned 
ports, and open these ports in the firewall. 

To this end, on the nfs server 

1) Create a file /etc/sysconfig/nfs with the following contents:

RQUOTAD_PORT=4000
LOCKD_TCPPORT=4001
LOCKD_UDPPORT=4001
MOUNTD_PORT=4002
STATD_PORT=4003

The nfs config file already exists, but it's full of comments. Erase 
everything and put these lines in, or just edit the appropriate lines in 
the existing file. You can choose any ports available, not necessarily 
4000-4003.


2) Open range 4000-4003 tcp and udp in iptables. This you can do 
manually, but it can be done from system-config-firewall very easily and 
intuitively.

3) Open port 111 (portmapper) and 2049 (nfs) as well.

Done.


Now, from any client (which should be running the automounter (autofs) by 
default), you should be able to 

cd /net/nfsserver/exported/partition


I have all this up and running, and it's pretty cool to watch video that 
resides on my main pc (nfs server) on my big hdtv, via nfs and a wireless 
laptop that sits on top of my tv. 


-- 
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora Magazine]     [Fedora News]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [SSH]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux