NFS through firewall

[James Pifer]

> Besides the firewall, other things to check for are tcp wrappers
> (/etc/hosts.allow/deny - I once pulled hair over this one), and permisions
> of the partitions exported by the NFS server. 
> 
> On the client do a 
> 
> /usr/sbin/showmount -e nfs.server.com
> 
> Whenever you modify something on the nfs server, run 
> 
> exportfs -r
> 
> or restart the nfs server (better, because it restarts the rpc services
> too).
> 
> 
> Also, you're not root on the client when you're trying to access the
> exports, are you? By default, the nfs server does not treat a remote root
> user as its own root user, for the obvious reasons. So if you're root on
> the client and try to access an exported partition that belongs to, say,
> joe/users, you'll get an error.
> 
> 
> Also, the nfs server need not give unrestricted access to a client to
> access nfs. The problem with nfs and firewall is that the rpc services run
> on random ports, so the firewall would have to open the same (random)
> ports to allow access to nfs. Fortunately, nfsd can be configured so that
> the rpc services run on fixed ports, like so:
> 
> On the nfs server:
> 
> cat /etc/sysconfig/nfs
> STATD_PORT=4000
> LOCKD_TCPPORT=4001
> LOCKD_UDPPORT=4001
> MOUNTD_PORT=4002
> RQUOTAD_PORT=4003
> 
> Still on the nfs server, in /etc/sysconfig/iptables put these rules:
> 
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2049 -j ACCEPT-A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 2049 -j ACCEPT-A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 111 -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 111 -j ACCEPT
> -A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 4000:4003 -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 4000:4003 -j ACCEPT
> 
> These will allow anything to access the nfs/rpc ports. To allow a
> only single machine, add its address to these rules.
> 
> 

Yes, I am root on the client. I do this all the time with my other
fedora boxes. For that matter, to use mount I have to be root. I don't
understand this part.

I will try to set fixed ports and see if that helps. 

Thanks,
James