[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

iptables blocking client NFS access



Hello psyche-list,

I've got a couple of RH 8.0 systems on a network. On one of these,
I've set up a couple of entries in /etc/exports and set up NFS. On
this (server) machine, I have opened up the iptables firewall to allow
incoming tcp/udp ports 111 and 2049.

On another (client) system, I've also opened up the iptables firewall
to allow incoming tcp/udp ports 111 and 2049. On this client, I have
been able to NFS mount just fine, if I "/etc/init.d/iptables stop"
first. After a lot of trial and error, I determined that the iptables
line "at fault" is the one that blocks all incoming 0:1023 udp
traffic.

Now, I'm stuck. I'd like to leave that line in the firewall, but I
would also like this machine to be able to be an NFS client.

I have not yet tried any other client machines.

Below is my iptables file. Any ideas? Thanks!

Ron.

# Generated by iptables-save v1.2.6a on Thu Feb  6 16:37:17 2003
*nat
:PREROUTING ACCEPT [1:48]
:POSTROUTING ACCEPT [2:200]
:OUTPUT ACCEPT [2:200]
COMMIT
# Completed on Thu Feb  6 16:37:17 2003
# Generated by iptables-save v1.2.6a on Thu Feb  6 16:37:17 2003
*mangle
:PREROUTING ACCEPT [800:38591]
:INPUT ACCEPT [800:38591]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1380:888103]
:POSTROUTING ACCEPT [1380:888103]
COMMIT
# Completed on Thu Feb  6 16:37:17 2003
# Generated by iptables-save v1.2.6a on Thu Feb  6 16:37:17 2003
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:RH-Lokkit-0-50-INPUT - [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -j RH-Lokkit-0-50-INPUT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 80 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp -i eth0 --dport 67:68 --sport 67:68 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp -i eth1 --dport 67:68 --sport 67:68 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 111 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 111 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 137:139 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 137:139 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --tcp-flags SYN,RST,ACK SYN -j REJECT  --reject-with icmp-port-unreachable 
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT  --reject-with icmp-port-unreachable 
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --tcp-flags SYN,RST,ACK SYN -j REJECT  --reject-with icmp-port-unreachable 
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --tcp-flags SYN,RST,ACK SYN -j REJECT  --reject-with icmp-port-unreachable 
COMMIT
# Completed on Thu Feb  6 16:37:17 2003





[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]