2006-07-06 15:52:08

by Ian Grant

[permalink] [raw]
Subject: Help with UDP NFS firewall rules

Dear NFS people,

I am trying to access NFS services running on a 2.4.20 kernel, using UDP. The client is running SUSE 9.3 with kernel 2.6.11.4-21.12 and iptables acting as a firewall.

The problem is that the nfsd on the server sends UDP replies to random ports <1024 on the client. Is there a way to fix the port chosen on the client end so that I can make a hole in the firewall for it?

Ian Grant

Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs


2006-07-06 17:07:12

by Trond Myklebust

[permalink] [raw]
Subject: Re: Help with UDP NFS firewall rules

On Thu, 2006-07-06 at 16:51 +0100, Ian Grant wrote:
> Dear NFS people,
>
> I am trying to access NFS services running on a 2.4.20 kernel, using UDP. The client is running SUSE 9.3 with kernel 2.6.11.4-21.12 and iptables acting as a firewall.
>
> The problem is that the nfsd on the server sends UDP replies to random ports <1024 on the client. Is there a way to fix the port chosen on the client end so that I can make a hole in the firewall for it?
>
> Ian Grant

That is unfortunately not possible at this time. Is there any reason why
you can't use TCP?

Cheers,
Trond


Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

2006-07-06 18:46:55

by Piete Brooks

[permalink] [raw]
Subject: Re: Help with UDP NFS firewall rules

> That is unfortunately not possible at this time.

:-(

> Is there any reason why you can't use TCP?

That's the plan, but it's a legacy system providing an internet service.
It's "on the list" to be upgraded "Real Soon Now".
It may now be moved up the list :-)

Thanks.


Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

2006-07-07 10:49:37

by Ian Grant

[permalink] [raw]
Subject: Re: Help with UDP NFS firewall rules


On 6 Jul 2006, at 18:06, Trond Myklebust wrote:

> On Thu, 2006-07-06 at 16:51 +0100, Ian Grant wrote:
>> Dear NFS people,
>>
>> I am trying to access NFS services running on a 2.4.20 kernel,
>> using UDP. The client is running SUSE 9.3 with kernel
>> 2.6.11.4-21.12 and iptables acting as a firewall.
>>
>> The problem is that the nfsd on the server sends UDP replies to
>> random ports <1024 on the client. Is there a way to fix the port
>> chosen on the client end so that I can make a hole in the firewall
>> for it?
>>
>> Ian Grant
>
> That is unfortunately not possible at this time. Is there any
> reason why
> you can't use TCP?

Hi Trond,

Thanks. TCP doesn't work because the server host is multi-homed and
the NFS server is using the wrong source IP address which defeats the
iptables TCP connection tracking in the client.

I have just opened up the client to all UDP from port 2049 on the
server and this is OK for now.

Cheers
Ian


Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs