nfs issue...

[Pete Nesbitt]

On July 1, 2004 08:50 pm, bruce wrote:
> pete...
>
> thanks for the input... i have the following /etc/sysconfig/iptables file
>
>
> # Firewall configuration written by lokkit
> # Manual customization of this file is not recommended.
> # Note: ifup-post will punch the current nameservers through the
> #       firewall; such entries will *not* be listed here.
> *filter
>
> :INPUT ACCEPT [0:0]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> :RH-Lokkit-0-50-INPUT - [0:0]
>
> -A INPUT -j RH-Lokkit-0-50-INPUT
> -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
> -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 21 --syn -j ACCEPT
> -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT
> -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 25 --syn -j ACCEPT
> -A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT
> -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --syn -j REJECT
> -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT
> -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT
> -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT
> -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --syn -j REJECT
> -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --syn -j REJECT
> COMMIT
>
> but i'm leary of making changes to it directly, as some other app might
> over-ride the changes... is there some way of me determining if there is
> some app that i should be be modifying/looking for, which would create this
> file...
>
> thanks...
>
> bruce
>

The only apps that are going to write to it is the redhat-config-securitylevel  
or the save feature of the  /etc/init.d/iptables ('service iptables save').
As long as you have a backup copy, you can always restore. Also, if I am 
reading that ruleset properly, it looks like most things are open (but I am 
not familiar with that formating).

Anyway, just comment out the two existing "2049 reject" lines and add them in 
as accepts.

-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049  -j ACCEPT
# -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT
# -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT

After editing the file, run 'service iptables restart' to kick the changes 
into gear.

If this system is accessed from beyond a trusted LAN, I would look seriously 
at implementing something a little stronger for the firewall rules.
-- 
Pete Nesbitt, rhce