Hi

I am running an NFS server but have not been able to find which ports need
to be open for the server to be available to clients.

rpcinfo -p indicates :

program vers proto   port
100000    2   tcp    111  portmapper
100000    2   udp    111  portmapper
100024    1   udp    940  status
100024    1   tcp    943  status
100003    2   udp   2049  nfs
100003    2   tcp   2049  nfs
100005    1   udp    980  mountd
100005    2   udp    980  mountd
100005    1   tcp    983  mountd
100005    2   tcp    983  mountd

I have tried opening all the ports above, but unless I drop the firewall
completely, clients are unable to access it.

Thanks.

[ Post a follow-up to this message ]

"Madhusudan Singh" <spammers-go-here@spam.invalid> wrote in message
news:4374db22$0$41140$14726298@news.sunsite.dk

> I am running an NFS server but have not been able to find which ports
> need to be open for the server to be available to clients.
>
> rpcinfo -p indicates :
>    program vers proto   port
...
>     100003    2   udp   2049  nfs
>     100003    2   tcp   2049  nfs
...

$ grep nfs /etc/services
nfs             2049/tcp        nfsd
nfs             2049/udp        nfsd

> I have tried opening all the ports above, but unless I drop the
> firewall completely, clients are unable to access it.

That seems to indicate that the tcp/udp port 2049 is either not open then,
or else you have failed to enable "/sbin/iptables -A INPUT -m state --state
ESTABLISHED,RELATED -j ACCEPT" assuming you are using netfilter as firewall.

[ Post a follow-up to this message ]

Madhusudan Singh <spammers-go-here@spam.invalid> told us in 'linux.redhat':

> Hi
>
> I am running an NFS server but have not been able to find which ports need
> to be open for the server to be available to clients.
>
> rpcinfo -p indicates :
>
>    program vers proto   port
>     100000    2   tcp    111  portmapper
>     100000    2   udp    111  portmapper
>     100024    1   udp    940  status
>     100024    1   tcp    943  status
>     100003    2   udp   2049  nfs
>     100003    2   tcp   2049  nfs
>     100005    1   udp    980  mountd
>     100005    2   udp    980  mountd
>     100005    1   tcp    983  mountd
>     100005    2   tcp    983  mountd
>
> I have tried opening all the ports above, but unless I drop the firewall
> completely, clients are unable to access it.
>
> Thanks.

some ports are generated randomly. So you have to set up NFS to use fix
ports. Start looking at:

http://www.lowth.com/LinWiz/nfs_help.html


tx

[ Post a follow-up to this message ]

On Fri, 11 Nov 2005 07:57:29 -0500, Madhusudan Singh
<spammers-go-here@spam.invalid> wrote:

>Hi
>
>I am running an NFS server but have not been able to find which ports need
>to be open for the server to be available to clients.
>
>rpcinfo -p indicates :
>
>   program vers proto   port
>    100000    2   tcp    111  portmapper
>    100000    2   udp    111  portmapper
>    100024    1   udp    940  status
>    100024    1   tcp    943  status
>    100003    2   udp   2049  nfs
>    100003    2   tcp   2049  nfs
>    100005    1   udp    980  mountd
>    100005    2   udp    980  mountd
>    100005    1   tcp    983  mountd
>    100005    2   tcp    983  mountd
>
>I have tried opening all the ports above, but unless I drop the firewall
>completely, clients are unable to access it.
>
>Thanks.

Check the logs for any hints, and setup a sniffer like ethereal, run
it, and see what's going on.

MT

[ Post a follow-up to this message ]

On Fri, 11 Nov 2005 07:57:29 -0500, Madhusudan Singh wrote:

> Hi
>
> I am running an NFS server but have not been able to find which ports need
> to be open for the server to be available to clients.
>
> rpcinfo -p indicates :
>
>    program vers proto   port
>     100000    2   tcp    111  portmapper
>     100000    2   udp    111  portmapper
>     100024    1   udp    940  status
>     100024    1   tcp    943  status
>     100003    2   udp   2049  nfs
>     100003    2   tcp   2049  nfs
>     100005    1   udp    980  mountd
>     100005    2   udp    980  mountd
>     100005    1   tcp    983  mountd
>     100005    2   tcp    983  mountd
>
> I have tried opening all the ports above, but unless I drop the firewall
> completely, clients are unable to access it.
>
> Thanks.

Turn off the firewall on the server, and it should work. Of course, you
want to do nfs with a firewall, and things get a little tricker.

nfs always runs on port 2049 tcp,udp, and portmap runs on 111.
However, rpc.mountd, rpc.statd, rpc.lockd, rpc, rpc.quotad are at the
mercy of the portmapper, and run on random ports. This is ok if
there is no firewall on the nfs server.

With a firewall, you need to open the ports on which the rpc services
run, so the rpc services must be bound to fixed ports. To this end,
notice that (on FC and probably other RH)

(a) nfs and all rpc's except rpc.statd are started by
/etc/rc.d/init.d/nfs

(b) rpc.statd/rpc.lockd are started by /etc/rc.d/init.d/nfslock

(c) both .../nfslock and .../nfs source /etc/sysconfig/nfs to
read some variables, which can include what ports to run the services
on.


So on the server force the rpc services to start on whatever ports you
want by editing /etc/sysconfig/nfs:

> more /etc/sysconfig/nfs
STATD_PORT=4000
LOCKD_TCPPORT=4001
LOCKD_UDPPORT=4001
MOUNTD_PORT=4002
RQUOTAD_PORT=4003


Now that you know which ports you can expect the rpc's to run on, put
these rules in /etc/sysconfig/iptables to open the nfs ports on
the server:

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2049 -j AC
CEPT
-A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 2049 -j AC
CEPT
-A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 111 -j ACC
EPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 111 -j ACC
EPT
-A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 4000:4003 
-j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 4000:4003 
-j ACCEPT

[ Post a follow-up to this message ]

Amadeus W. M. wrote:

> On Fri, 11 Nov 2005 07:57:29 -0500, Madhusudan Singh wrote:
> 
>
> Turn off the firewall on the server, and it should work. Of course, you
> want to do nfs with a firewall, and things get a little tricker.
>
> nfs always runs on port 2049 tcp,udp, and portmap runs on 111.
> However, rpc.mountd, rpc.statd, rpc.lockd, rpc, rpc.quotad are at the
> mercy of the portmapper, and run on random ports. This is ok if
> there is no firewall on the nfs server.
>
> With a firewall, you need to open the ports on which the rpc services
> run, so the rpc services must be bound to fixed ports. To this end,
> notice that (on FC and probably other RH)
>
> (a) nfs and all rpc's except rpc.statd are started by
> /etc/rc.d/init.d/nfs
>
> (b) rpc.statd/rpc.lockd are started by /etc/rc.d/init.d/nfslock
>
> (c) both .../nfslock and .../nfs source /etc/sysconfig/nfs to
> read some variables, which can include what ports to run the services
> on.
>
>
> So on the server force the rpc services to start on whatever ports you
> want by editing /etc/sysconfig/nfs:
> 
> STATD_PORT=4000
> LOCKD_TCPPORT=4001
> LOCKD_UDPPORT=4001
> MOUNTD_PORT=4002
> RQUOTAD_PORT=4003
>
>
> Now that you know which ports you can expect the rpc's to run on, put
> these rules in /etc/sysconfig/iptables to open the nfs ports on
> the server:
>
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2049 -j
> ACCEPT -A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport
> 2049 -j ACCEPT -A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp
> --dport 111 -j ACCEPT -A RH-Firewall-1-INPUT -p tcp -m state --state NEW
> -m tcp --dport 111 -j ACCEPT -A RH-Firewall-1-INPUT -p udp -m state
> --state NEW -m udp --dport 4000:4003 -j ACCEPT -A RH-Firewall-1-INPUT -p
> tcp -m state --state NEW -m tcp --dport 4000:4003 -j ACCEPT

Many thanks for your hints, but your instructions seem to be very RH
specific. I am using Debian.

[ Post a follow-up to this message ]

tx wrote:

> Madhusudan Singh <spammers-go-here@spam.invalid> told us in
> 'linux.redhat':
> 
>
> some ports are generated randomly. So you have to set up NFS to use fix
> ports. Start looking at:
>
> http://www.lowth.com/LinWiz/nfs_help.html
>
>
> tx

Very RH specific. Any links that are a little more general would be welcome.
Thanks.

[ Post a follow-up to this message ]

quote:
Very RH specific. Any links that are a little more general would be welcome.
Thanks. [/B]
 

I'm running Debian and this is how I think it's supposed to be done:

In /etc/default/nfs-kernel-server I edited the last line so it reads RPCMOUN
TDOPTS="-p 4002"

then restart with /etc/init.d/nfs-kernel-server restart

[ Post a follow-up to this message ]