firewall settings

[Rick Stevens]

On Wed, 2007-01-24 at 12:22 -0800, chuck lawrence wrote:
> this is my first serious attempt to config a firewall...
> 
> at installation, I asked for the firewall setting of ssh-only, or so I 
> believe.  I was surprised, then, to find nfs working (I have a potential 
> nfs client behind a firewall, and I'm trying to create a test box to 
> troubleshoot before asking for holes in *that* firewall).

How do you know NFS was working?  The fact that the nfsd daemon is
running doesn't mean NFS is functional.  Connections need to go through
the firewall.

> is that to be expected?  am I missing something?

Not necessarily.  Again, having portmap and nfsd doesn't mean people
can get to your server.  If the firewall blocks access to portmap and
the daemon, people can't mount your NFS shares.

> also, with my local firewall running(?), web access works, but is 
> excruciatingly slow - like 45 seconds to open a page.

That's probably because you have DNS blocked as well.  Make sure you
leave port UDP port 53 open (it might be good to leave TCP port 53 open
as well).

I'd recommend running nmap or nmapfe against your machine's IP and see
what ports really are open.  Make sure you use the real IP and not
localhost (127.0.0.1).

----------------------------------------------------------------------
- Rick Stevens, Senior Systems Engineer     rstevens at vitalstream.com -
- VitalStream, Inc.                       http://www.vitalstream.com -
-                                                                    -
-   You possess a mind not merely twisted, but actually sprained.    -
----------------------------------------------------------------------