Re: NFS connection dropped

"Dr. Michael J. Chudobiak" <[email protected]>
Newsgroups gmane.network.guarddog
Organization Avtech Electrosystems Ltd.
Message-ID <[email protected]>
K. Elo wrote:
 > Sep  1 09:03:30 Elot kernel: DROPPED IN=eth0 OUT=
 > MAC=ff:ff:ff:ff:ff:ff:00:c0:9f:bc:fd:a2:08:00 SRC=192.168.1.2
 > DST=192.168.1.255 LEN=120 TOS=0x00 PREC=0x00 TTL=64 ID=3 DF PROTO=UDP
 > SPT=1025 DPT=111 LEN=100
...
 > The port 111 the client is trying to connect to is the SUN remote
 > procedure call. In my GD configuration this protocol _is_ served from
 > both "local" and "h-network" to clients in "h-network"/"local"!!! So
 > why on earth are connections to this port dropped by GD?!?!?! The
 > "h-network" zone address range is 192.168.1.0/255.255.255.0 so the DST
 > 192.168.1.255 should fit into this range, right??
 >
 > Once again: the protocols permitted between "local" and "h-network" are:
 > NFS, rsync, SUN remote procedure call, ssh, ping, ident/auth. Should
 > there be some in addition to these (e.g. ftp)?
 >
 > Any ideas?
 >
 > Kind regards,
 > Kimmo


Kimmo,

Port 1025 is the problem in the above log. Its being blocked, not 111. 
However, the ports used by NFS are usually NOT static. It might be 1025 
today, 9999 tomorrow. You have to "pin" the NFS ports, and open the 
firewall for them. To do this:


1. Create the file "/etc/sysconfig/nfs" and add the following contents:

STATD_PORT=4001
LOCKD_TCPPORT=4002
LOCKD_UDPPORT=4002
MOUNTD_PORT=4003


2. Append the following to the file "/etc/services":

rquotad 4004/tcp # rpc.rquotad tcp port
rquotad 4004/udp # rpc.rquotad udp port


3. Restart the nfs services:

/etc/init.d/nfs restart
/etc/init.d/nfslock restart


4. Run /usr/sbin/rpcinfo -p and make sure the ports above have changed.


5. Add a custom protocol in the advanced tab of guarddog for ports 
4001-4004, for both udp and tcp. Enable these protocols. In the end, 
these ports should be open:

111:tcp, 111:udp, 2049:tcp, 2049:udp, 4001:tcp, 4001:udp, 4002:tcp, 
4002:udp, 4003:tcp, 4003:udp, 4004:tcp, 4004:udp



This works for me (on Fedora Core 4) - after much painful research!


- Mike


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.