On Wed, 2010-06-02 at 14:48 +0200, Ferenc Wagner wrote:
> Guillaume Rousse <[email protected]> writes:
>=20
> > Le 02/06/2010 13:37, Ferenc Wagner a =C3=A9crit :
> >=20
> >> I read that letting NFS4 through firewalls is quite easy and entai=
ls
> >> opening up port 2049 of the server only. It indeed works. But ou=
r NFS
> >> client has its own firewall as well, and that logs backward connec=
tion
> >> attempts from low (665-1022) ports of the NFS4 server to port 5947=
3 of
> >> the client. These connections aren't let through, but I wonder if=
they
> >> should be, and if it's NFS related at all...
> >
> > They are delegation callbacks. If those connections can't succeed, =
you
> > wont' have delegation support.
>=20
> Thank you for the quick and clear explanation. Is there some "best
> practice" available for firewalling delegation callbacks? If that's
> infeasible, is there any way to explicitly disable delegation support=
in
> the server, to suppress the useless trials?
On the NFS client, you should set the 'nfs.callback_tcpport' kernel
parameter to a known port number, then open that TCP port for incoming
connections on your firewall.
e.g. if you decide to open TCP port 2050, then you should add something
like the following line to /etc/modprobe.d/options-nfs.conf:
options nfs callback_tcpport=3D2050
Then either reboot the client, or unload, its nfs kernel module and
reload it...
Cheers
Trond