|
Home > Archive > Linux Debian support > April 2006 > NFS server ports ?
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
NFS server ports ?
|
|
| Madhusudan Singh 2005-11-11, 8:46 pm |
| Hi
I am running an NFS server but have not been able to find which ports need
to be open for the server to be available to clients.
rpcinfo -p indicates :
program vers proto port
100000 2 tcp 111 portmapper
100000 2 udp 111 portmapper
100024 1 udp 940 status
100024 1 tcp 943 status
100003 2 udp 2049 nfs
100003 2 tcp 2049 nfs
100005 1 udp 980 mountd
100005 2 udp 980 mountd
100005 1 tcp 983 mountd
100005 2 tcp 983 mountd
I have tried opening all the ports above, but unless I drop the firewall
completely, clients are unable to access it.
Thanks.
| |
| ynotssor 2005-11-11, 8:46 pm |
| "Madhusudan Singh" <spammers-go-here@spam.invalid> wrote in message
news:4374db22$0$41140$14726298@news.sunsite.dk
> I am running an NFS server but have not been able to find which ports
> need to be open for the server to be available to clients.
>
> rpcinfo -p indicates :
> program vers proto port
....
> 100003 2 udp 2049 nfs
> 100003 2 tcp 2049 nfs
....
$ grep nfs /etc/services
nfs 2049/tcp nfsd
nfs 2049/udp nfsd
> I have tried opening all the ports above, but unless I drop the
> firewall completely, clients are unable to access it.
That seems to indicate that the tcp/udp port 2049 is either not open then,
or else you have failed to enable "/sbin/iptables -A INPUT -m state --state
ESTABLISHED,RELATED -j ACCEPT" assuming you are using netfilter as firewall.
| |
|
| Madhusudan Singh <spammers-go-here@spam.invalid> told us in 'linux.redhat':
> Hi
>
> I am running an NFS server but have not been able to find which ports need
> to be open for the server to be available to clients.
>
> rpcinfo -p indicates :
>
> program vers proto port
> 100000 2 tcp 111 portmapper
> 100000 2 udp 111 portmapper
> 100024 1 udp 940 status
> 100024 1 tcp 943 status
> 100003 2 udp 2049 nfs
> 100003 2 tcp 2049 nfs
> 100005 1 udp 980 mountd
> 100005 2 udp 980 mountd
> 100005 1 tcp 983 mountd
> 100005 2 tcp 983 mountd
>
> I have tried opening all the ports above, but unless I drop the firewall
> completely, clients are unable to access it.
>
> Thanks.
some ports are generated randomly. So you have to set up NFS to use fix
ports. Start looking at:
http://www.lowth.com/LinWiz/nfs_help.html
tx
| |
| Michael Thomas 2005-11-11, 8:46 pm |
| On Fri, 11 Nov 2005 07:57:29 -0500, Madhusudan Singh
<spammers-go-here@spam.invalid> wrote:
>Hi
>
>I am running an NFS server but have not been able to find which ports need
>to be open for the server to be available to clients.
>
>rpcinfo -p indicates :
>
> program vers proto port
> 100000 2 tcp 111 portmapper
> 100000 2 udp 111 portmapper
> 100024 1 udp 940 status
> 100024 1 tcp 943 status
> 100003 2 udp 2049 nfs
> 100003 2 tcp 2049 nfs
> 100005 1 udp 980 mountd
> 100005 2 udp 980 mountd
> 100005 1 tcp 983 mountd
> 100005 2 tcp 983 mountd
>
>I have tried opening all the ports above, but unless I drop the firewall
>completely, clients are unable to access it.
>
>Thanks.
Check the logs for any hints, and setup a sniffer like ethereal, run
it, and see what's going on.
MT
| |
| Amadeus W. M. 2005-11-13, 2:46 am |
| On Fri, 11 Nov 2005 07:57:29 -0500, Madhusudan Singh wrote:
> Hi
>
> I am running an NFS server but have not been able to find which ports need
> to be open for the server to be available to clients.
>
> rpcinfo -p indicates :
>
> program vers proto port
> 100000 2 tcp 111 portmapper
> 100000 2 udp 111 portmapper
> 100024 1 udp 940 status
> 100024 1 tcp 943 status
> 100003 2 udp 2049 nfs
> 100003 2 tcp 2049 nfs
> 100005 1 udp 980 mountd
> 100005 2 udp 980 mountd
> 100005 1 tcp 983 mountd
> 100005 2 tcp 983 mountd
>
> I have tried opening all the ports above, but unless I drop the firewall
> completely, clients are unable to access it.
>
> Thanks.
Turn off the firewall on the server, and it should work. Of course, you
want to do nfs with a firewall, and things get a little tricker.
nfs always runs on port 2049 tcp,udp, and portmap runs on 111.
However, rpc.mountd, rpc.statd, rpc.lockd, rpc, rpc.quotad are at the
mercy of the portmapper, and run on random ports. This is ok if
there is no firewall on the nfs server.
With a firewall, you need to open the ports on which the rpc services
run, so the rpc services must be bound to fixed ports. To this end,
notice that (on FC and probably other RH)
(a) nfs and all rpc's except rpc.statd are started by
/etc/rc.d/init.d/nfs
(b) rpc.statd/rpc.lockd are started by /etc/rc.d/init.d/nfslock
(c) both .../nfslock and .../nfs source /etc/sysconfig/nfs to
read some variables, which can include what ports to run the services
on.
So on the server force the rpc services to start on whatever ports you
want by editing /etc/sysconfig/nfs:
> more /etc/sysconfig/nfs
STATD_PORT=4000
LOCKD_TCPPORT=4001
LOCKD_UDPPORT=4001
MOUNTD_PORT=4002
RQUOTAD_PORT=4003
Now that you know which ports you can expect the rpc's to run on, put
these rules in /etc/sysconfig/iptables to open the nfs ports on
the server:
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2049 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 2049 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 111 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 111 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 4000:4003 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 4000:4003 -j ACCEPT
| |
| Madhusudan Singh 2005-11-19, 5:46 pm |
| Amadeus W. M. wrote:
> On Fri, 11 Nov 2005 07:57:29 -0500, Madhusudan Singh wrote:
>
>
> Turn off the firewall on the server, and it should work. Of course, you
> want to do nfs with a firewall, and things get a little tricker.
>
> nfs always runs on port 2049 tcp,udp, and portmap runs on 111.
> However, rpc.mountd, rpc.statd, rpc.lockd, rpc, rpc.quotad are at the
> mercy of the portmapper, and run on random ports. This is ok if
> there is no firewall on the nfs server.
>
> With a firewall, you need to open the ports on which the rpc services
> run, so the rpc services must be bound to fixed ports. To this end,
> notice that (on FC and probably other RH)
>
> (a) nfs and all rpc's except rpc.statd are started by
> /etc/rc.d/init.d/nfs
>
> (b) rpc.statd/rpc.lockd are started by /etc/rc.d/init.d/nfslock
>
> (c) both .../nfslock and .../nfs source /etc/sysconfig/nfs to
> read some variables, which can include what ports to run the services
> on.
>
>
> So on the server force the rpc services to start on whatever ports you
> want by editing /etc/sysconfig/nfs:
>
> STATD_PORT=4000
> LOCKD_TCPPORT=4001
> LOCKD_UDPPORT=4001
> MOUNTD_PORT=4002
> RQUOTAD_PORT=4003
>
>
> Now that you know which ports you can expect the rpc's to run on, put
> these rules in /etc/sysconfig/iptables to open the nfs ports on
> the server:
>
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2049 -j
> ACCEPT -A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport
> 2049 -j ACCEPT -A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp
> --dport 111 -j ACCEPT -A RH-Firewall-1-INPUT -p tcp -m state --state NEW
> -m tcp --dport 111 -j ACCEPT -A RH-Firewall-1-INPUT -p udp -m state
> --state NEW -m udp --dport 4000:4003 -j ACCEPT -A RH-Firewall-1-INPUT -p
> tcp -m state --state NEW -m tcp --dport 4000:4003 -j ACCEPT
Many thanks for your hints, but your instructions seem to be very RH
specific. I am using Debian.
| |
| Madhusudan Singh 2005-11-19, 5:46 pm |
| tx wrote:
> Madhusudan Singh <spammers-go-here@spam.invalid> told us in
> 'linux.redhat':
>
>
> some ports are generated randomly. So you have to set up NFS to use fix
> ports. Start looking at:
>
> http://www.lowth.com/LinWiz/nfs_help.html
>
>
> tx
Very RH specific. Any links that are a little more general would be welcome.
Thanks.
| |
| Inkvisitor 2006-04-28, 5:11 am |
| quote:
Very RH specific. Any links that are a little more general would be welcome.
Thanks. [/B]
I'm running Debian and this is how I think it's supposed to be done:
In /etc/default/nfs-kernel-server I edited the last line so it reads RPCMOUNTDOPTS="-p 4002"
then restart with /etc/init.d/nfs-kernel-server restart |
|
|
|
|