Firewall and nfs mounts

Anne Wilson annew at kde.org
Thu Aug 27 09:50:39 UTC 2009


On Wednesday 26 August 2009 19:41:02 Todd Denniston wrote:
> Anne Wilson wrote, On 12/23/-28158 02:59 PM:
> > On Tuesday 25 August 2009 00:16:28 Ed Greshko wrote:
> >> Anne Wilson wrote:
> >>> On Monday 24 August 2009 15:44:20 Bill McGonigle wrote:
> >>>> On 08/24/2009 08:15 AM, Anne Wilson wrote:
> >>>>> What ports are necessarily opened on an nfs server?  Does the client
> >>>>> need any ports opened?
> >>>>
> >>>> If you can limit yourself to NFSv4 you're much better off in this
> >>>> department.  I have this on an NFSv4 server:
> >>>>
> >>>> # NFS
> >>>>   -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --source
> >>>> 192.168.1.32/27 --dport 2049 -j ACCEPT
> >>>>
> >>>> and nothing on a working client other than the standard:
> >>>>
> >>>>   -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> >>>
> >>> Thanks.  That's something to work on.  Although I have had a working
> >>> firewall in the past, I'm not really familiar with iptables setup. 
> >>> Since a gui tool was provided I expected it to do the necessary (this
> >>> is system-config- securitylevels on CentOS) but it doesn't.  I used
> >>> shorewall to set up my firewall long ago, and I'm beginning to think I
> >>> might be better of seeing if there's a package for CentOS.  Gui tools
> >>> seem nice, but I don't like the fact that they rarely tell you what the
> >>> are and aren't doing.
> >>
> >> When it comes to a shorewall package for CentOS or RHEL you can enable
> >> the EPEL repository https://fedoraproject.org/wiki/EPEL
> >
> > Thanks, Ed.  I should be able to get to that tomorrow.  The thing is that
> > I only want nfs across the lan.  The router would stop any external
> > attempts to use nfs mounting, so it seems to me that trusting the local
> > zone might be all that's needed.  I think that is straightforward, IIRC,
> > in shorewall.
> >
> > Anne
>
> Anne,
> If you are using NFS V2/3 instead of 4 (TCP) then the following might be as
> useful to you as it was to me. :)
> http://kbase.redhat.com/faq/docs/DOC-3259
>
Hi, Todd.  No, I'm using NFS4.  I'm getting some off-list help, so it won't be 
immediate, but I have hopes of finding where the problem lies and dealing with 
it.

> Of course if you had time/inclination you would be using something other
> than the 10000-10005 range where everyone will now be looking for your NFS,
> if they could only find a way to get past your router. :)

:-)  I'll bear that in mind, once I have the thing working.  At the moment, 
with the firewall enabled, even I can't reach my home directory, so I'm not 
exactly worried about others doing so :-)

Anne
-- 
New to KDE4? - get help from http://userbase.kde.org
Just found a cool new feature?  Add it to UserBase
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20090827/5b00ae55/attachment-0001.sig>


More information about the fedora-list mailing list