ipfilter and nfs

ipfilter and nfs

Post by kevi » Thu, 23 Jan 2003 00:38:28



hi newsgroup

i thought to know that nfs needs TCP/111, UDP/111, TCP/2049, UDP/2049 so
i made the following ipf rule:

pass in quick on xl0 proto tcp/udp from any to any port = 111 keep state
pass in quick on xl0 proto tcp/udp from any to any port = 2049 keep state

when i go on another machine and make:

$ showmount -e thebox

it hangs. if i make ipf -D on the server the shares are ssen.

$ mount -t thebox:/data /mnt

also hangs

my rc.conf settings:

nfs_server_enable="YES"
nfs_client_enable="YES"
nfs_reserved_port_only="YES"

can anyone tell me what i am doing wrong?

thanks in advance
kevin

 
 
 

ipfilter and nfs

Post by kevi » Thu, 23 Jan 2003 00:40:01


sorry of corse i mean:

Quote:> $ mount -t nfs thebox:/data /mnt


 
 
 

ipfilter and nfs

Post by Dan Fost » Thu, 23 Jan 2003 04:31:12




>hi newsgroup

>i thought to know that nfs needs TCP/111, UDP/111, TCP/2049, UDP/2049 so
>i made the following ipf rule:

>pass in quick on xl0 proto tcp/udp from any to any port = 111 keep state
>pass in quick on xl0 proto tcp/udp from any to any port = 2049 keep state

I wonder if also adding 1023 (for mountd) would be useful?

'rpcinfo -p' shows mountd listens on that port on my 4.7 machine but
I don't recall if that changes dynamically.

Your problem is basically that you're blocking the mount requests from
hitting mountd. That's why you can't mount. A NFS server has three major
components: portmapper (for RPC services registration), mountd, and nfsd.
Well, and rpc.statd, too. I'd guess that rpc.statd lives on dynamically
assigned ports and registered through the portmapper.

-Dan