LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 09-29-2015, 09:07 PM   #1
ron7000
Member
 
Registered: Nov 2007
Location: CT
Posts: 248

Rep: Reputation: 26
firewall settings and ports for nfs server


i seem to be running into a firewall problem,
this is on suse if it matters, sles 11.4. Have seen it happen on 11.3 also but never paid it much attention and when things got problematic I rebooted everyone and seemed to fix things.

if i have one linux server nfs serving a /data folder.
i set the ip address of the systems that are allowed to be a client, for example if server A (having ip address 192.168.1.1) has nfs server set up and exporting /data i specify the following can be allowed to nfs mount:
192.168.1.2
192.168.1.3
192.168.1.4
and so on.
And let's say in /etc/hosts i specify hostname B is 192.168.1.2, C is 3, D is 4 and so on.

normally i have only one or two ip addresses specified and things work fine for server A, and B and C can nfs mount /data from A no problem.
And in nfs-server within yast on server A it gives me the option to open port in firewall and that's checked however i don't know the specific details of what "nfs server" does in the firewall.

today i specified a few more clients that can mount /data from server A and it was maybe the 5th server when i told it to mount it failed. I tried /etc/init.d/nfs-server restart on server A with no luck. But if i turn off the firewall on server A then try to mount it immediately works, and once mounted if I then enable the firewall on server A without changing anything everything still works and that 5th server can still see everything under /data.

what gives?
 
Old 09-29-2015, 10:34 PM   #2
Rinndalir
Member
 
Registered: Sep 2015
Posts: 733

Rep: Reputation: Disabled
Run the appropriate iptables commands to show you what rules are "seeing" traffic. iptables -vnL might work but you might need to look at the man page and run iptables with other chain names besides the defaults.
 
Old 10-01-2015, 11:40 AM   #3
ron7000
Member
 
Registered: Nov 2007
Location: CT
Posts: 248

Original Poster
Rep: Reputation: 26
after reading up on nfs there's a few things happening that use random dynamic ports, and I believe i need to force those to a static non-changing value that i then have open on the firewall. has to do with mountd, lockd, statd.
and it seems to be a bad programming on the part of suse,
you can say "open port in firewall" within yast-nfs server but i think that only works if you have 1 export and only 1 client host specified, if you do more then nfs starts using more ports that are not open in the firewall.

Last edited by ron7000; 10-01-2015 at 11:42 AM.
 
Old 10-02-2015, 10:07 AM   #4
ron7000
Member
 
Registered: Nov 2007
Location: CT
Posts: 248

Original Poster
Rep: Reputation: 26
Quote:
## Path: Network/File systems/NFS server
## Description: use fixed port number for mountd
## Type: integer
## Default: ""
## ServiceRestart: nfsserver
#
# Only set this if you want to start mountd on a fixed
# port instead of the port assigned by rpc. Only for use
# to export nfs-filesystems through firewalls.
#
MOUNTD_PORT=""
so after reading some nfs crap on the web they say go look in /etc/sysconfig/nfs and set some stuff.
behold the mountd_port = "" set to nothing.

Hey Suse, it would be nice if you had this setting available in Yast NFS-server and Firewall and mentioned in your admin pdf documents.
You do realize you encourage the use of NFS and Firewall because it's there in Yast, and when you don't account for it in the firewall it results in FAILURE ?

this is why you guys suck and continue to take a back seat to Microsoft Windows.

what other ports do i need to force static to simply use both NFS and have the firewall enabled?
 
Old 10-04-2015, 10:00 PM   #5
ron7000
Member
 
Registered: Nov 2007
Location: CT
Posts: 248

Original Poster
Rep: Reputation: 26
so it seems i figured a lot of it out.
first there is the firewall and it's attempt to make it easy for you as in the attached pic.
This is not the case.
I'm starting to think it's best to not use any of the menu drop downs... even though it might be the enterprise version and you'd think because you are paying for it that it would work!!

from the advanced tab in the lower right, that opens a window and lets you specify the specific ports for TCP, UDP, RPC, and IP.
here is what I specified manually to get NFS server/client to work, so far reliably

TCP: 111 2049 10001:10004
UDP: 111 2049 10001:10004

as i found out earlier, a lot of what you need to do is in the text file /etc/sysconfig/nfs which you have to edit manually, at least it's laid out straightforward.
The following by default are not set and are blank, you have to add in your own values, those values are then what you specify in your firewall settings. I say 10001 to 10004 here as an example, I used something above that but less than 65535. I forget which ports below what value are system ports that you are not supposed to use, but I thought there was some port range that was also restricted but admin configurable. if someone has a better port range to recommend please let me know and the reason why.

These values are in /etc/sysconfig/nfs

MOUNTD_PORT="10001"
SM_NOTIFY_OPTIONS="-p 10002"
STATD_PORT="10003"
LOCKD_TCPPORT="10004'
LOCKD_UDPPORT="10004"

note: sm_notify_options needs the -p within the quotes to work properly, and it says so in the comments above it in the file.
Again this is for Suse Linux Enterprise server, 11.4 to be exact.

also not sure if i need udp opened in addition to tcp for everything, aside from lockd obviously.
but as soon as i set these up in the nfs file and opened those ports in the firewall, i can nfs mount on the client without delay and without error could not mount.

one other thing is RQUOTAD which was not listed in /etc/sysconfig/nfs. However i am not using quotas anywhere so i don't care about it at this point.
Attached Thumbnails
Click image for larger version

Name:	aa.jpg
Views:	69
Size:	141.5 KB
ID:	19732  

Last edited by ron7000; 10-04-2015 at 10:08 PM.
 
Old 10-04-2015, 11:05 PM   #6
ron7000
Member
 
Registered: Nov 2007
Location: CT
Posts: 248

Original Poster
Rep: Reputation: 26
for SLES, version 11.4

/etc/services
this is the file that has all the port numbers mapped to a number for tcp, udp, sctp.
so when the menu item in the firewall window says it's opening the SSH port for example, in this file you'll find
ssh 22/tcp # The Secure Shell (SSH) Protocol [RFC4251]
ssh 22/udp # The Secure Shell (SSH) Protocol [RFC4251]
ssh 22/sctp # SSH [Randall_Stewart] [RFC4960]

you'll also find {at least i found}
# ------------------------------------
sunrpc 111/tcp rpcbind # SUN Remote Procedure Call [Chuck_McManis]
sunrpc 111/udp rpcbind # SUN Remote Procedure Call [Chuck_McManis]
quotad 762/tcp
quotad 762/udp
notify 773/udp {ron7000 - i don't know if this pertains to sm_notify}
nfsd-keepalive 1110/udp # Client status info [Beth_Crespo]
nfs 2049/tcp # Network File System - Sun Microsystems [Brent_Callaghan]
nfs 2049/udp # Network File System - Sun Microsystems [Brent_Callaghan]
nfs 2049/sctp # Network File System [RFC5665]
mountd 20048/tcp # NFS mount protocol [Nicolas_Williams]
mountd 20048/udp # NFS mount protocol [Nicolas_Williams]
# ------------------------------------

here's where the firewall stuff happens... from what you see in the fancy menu {that in the end doesn't fulfill what's needed} to what ports actually get opened:

Under /etc/sysconfig/SuSEfirewall2.d/services you find files such as
- nfs-kernel-server
- nfs-client
- ntp
- sshd, cups {and so on, I have 15 plus a TEMPLATE file}
And it's these file names that show up in my drop down menu in the Yast Firewall gui for "services to allow" in the firewall. This is where I assumed that's all I needed to do... to use nfs just select "NFS Server Service" in the drop down. Hell, when you set up nfs server in yast it gives you a checkbox with "open port in firewall". You have that checked, it automatically adds "NFS server service" in your firewall allowed services, you think you're all good... not so fast.

so in file ntp for example, and every file it's all layed out the same
TCP=""
UDP="ntp"
RPC=""
IP=""
BROADCAST=""

ntp gets defined in /etc/services as port number 123, is that all there is to it?

so in my nfs-kernel-server file it has
TCP=""
UDP=""
RPC="portmap status nlockmgr mountd nfs nfs_acl"
IP=""
BROADCAST=""

now that's under RPC, and i can't find "nfs_acl" or "nlockmgr" in the /etc/services file.

so with nfs being port 2049 then how does the suse firewall gui in yast actually open that port?
Did they forget it?

regarding RPC port numbers, I see that happens under /etc/rpc and i find
# ------------------------------------
portmapper 100000 portmap sunrpc rpcbind
rstatd 100001 rstat rup perfmeter rstat_svc
nfs 100003 nfsprog
mountd 100005 mount showmount
rquotad 100011 rquotaprog quota rquota
nlockmgr 100021
status 100024
rpcnfs 100116 na.rpcnfs
# ------------------------------------

from here i gotta lookup how RPC works and what those numbers are all about, are they not port numbers since they are above a 16-bit {65535} value?

Last edited by ron7000; 10-04-2015 at 11:11 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Firewall blocking NFS even though ports are open OmnipotentOscar Linux - Security 13 01-25-2010 12:47 PM
SuSE 10.3 NFS Firewall Settings dcasper Linux - Server 1 10-15-2008 10:53 PM
NFS and firewall ports linuxhippy Slackware 2 05-06-2005 11:38 AM
Which ports to allow through firewall for X Server? vmnrao Linux - Networking 1 09-04-2004 05:49 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 08:53 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration