[SOLVED] What ipchains do you open on an NFS client

lock_nb · 01-05-2004, 08:37 PM

I have two RH7.2 boxes on a home LAN and I'm trying
to mount a share from one to the other.

If I stop iphains on both boxes everything works.

I know I need to configure ipchains on the server
but what do I do with the client.

If I turn on ipchains on the client I get an
RPC timeout error. Everything I read talks
about which server ports to open up to allow
RPC and portmapper to work.

Nothing I can find describes what do open up
on the client end.

Any thoughts??

GAVollink · 01-06-2004, 03:53 PM

The answer is none or all. Problem is that NFS is an RPC application, and RPC uses the lead RPC port to assign a pseudo-random port for the NFS application. So you'd have to open up a large block of ports for NFS to work.

If you firewall at all, then NFS is generally a bad idea. I use two NICs and a private sub-net for the NFS shares on my network. This way I simply "trust" one subnet - and block the other sub-net.

lock_nb · 01-06-2004, 06:28 PM

Thanks for the tip, I woke up and thought of the answer.

Your are right about the RPC. I native mode NFS uses
UDP based RPCs. Since there is no TCP session the
message from the server to the client are seen as
unsolicited message. Of course the ipchain rules will
block this.

By adding a rule to accept UDP messages from the
NFS server the whole thing works.