Hello <br />
<br />
According to RH Documentation, in order to use NFS behind firewall UDP port 111 has to be open.:<br />
<a href="http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Storage_Administration_Guide/s2-nfs-nfs-firewall-config.html">http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Storage_Administration_Guide/s2-nfs-nfs-firewall-config.html</a> [<a href="http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Storage_Administration_Guide/s2-nfs-nfs-firewall-config.html" target="_blank">^</a>]<br />
<br />
<br />
<br />
I installed system-config-firewall-tui and put a mark on NFSv4, so that this service be available.<br />
<br />
The results:<br />
<br />
<br />
[root@manager ~]# cat /etc/sysconfig/iptables<br />
# Firewall configuration written by system-config-firewall<br />
# Manual customization of this file is not recommended.<br />
*filter<br />
:INPUT ACCEPT [0:0]<br />
:FORWARD ACCEPT [0:0]<br />
:OUTPUT ACCEPT [0:0]<br />
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT<br />
-A INPUT -p icmp -j ACCEPT<br />
-A INPUT -i lo -j ACCEPT<br />
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT<br />
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT<br />
-A INPUT -m state --state NEW -m tcp -p tcp --dport 2049 -j ACCEPT<br />
-A INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT<br />
-A INPUT -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT<br />
-A INPUT -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT<br />
-A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT<br />
-A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT<br />
-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT<br />
-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT<br />
-A INPUT -m state --state NEW -m udp -p udp --dport 69 -j ACCEPT<br />
-A INPUT -j REJECT --reject-with icmp-host-prohibited<br />
-A FORWARD -j REJECT --reject-with icmp-host-prohibited<br />
COMMIT<br />
<br />
<br />
-> no port 111<br />
<br />
-> clients are not able to mount NFS exports<br />
-> stopping iptables or adding rule for udp:111 resolves the problem.<br />
<br />
?his report may be valid for system-config-firewall - please check.<br />
<br />
BR,<br />
Ivan Georgiev
↧