Re: NFS connection dropped
"Dr. Michael J. Chudobiak" <[email protected]>
| Newsgroups | gmane.network.guarddog |
|---|---|
| Organization | Avtech Electrosystems Ltd. |
| Message-ID | <[email protected]> |
K. Elo wrote: > Sep 1 09:03:30 Elot kernel: DROPPED IN=eth0 OUT= > MAC=ff:ff:ff:ff:ff:ff:00:c0:9f:bc:fd:a2:08:00 SRC=192.168.1.2 > DST=192.168.1.255 LEN=120 TOS=0x00 PREC=0x00 TTL=64 ID=3 DF PROTO=UDP > SPT=1025 DPT=111 LEN=100 ... > The port 111 the client is trying to connect to is the SUN remote > procedure call. In my GD configuration this protocol _is_ served from > both "local" and "h-network" to clients in "h-network"/"local"!!! So > why on earth are connections to this port dropped by GD?!?!?! The > "h-network" zone address range is 192.168.1.0/255.255.255.0 so the DST > 192.168.1.255 should fit into this range, right?? > > Once again: the protocols permitted between "local" and "h-network" are: > NFS, rsync, SUN remote procedure call, ssh, ping, ident/auth. Should > there be some in addition to these (e.g. ftp)? > > Any ideas? > > Kind regards, > Kimmo Kimmo, Port 1025 is the problem in the above log. Its being blocked, not 111. However, the ports used by NFS are usually NOT static. It might be 1025 today, 9999 tomorrow. You have to "pin" the NFS ports, and open the firewall for them. To do this: 1. Create the file "/etc/sysconfig/nfs" and add the following contents: STATD_PORT=4001 LOCKD_TCPPORT=4002 LOCKD_UDPPORT=4002 MOUNTD_PORT=4003 2. Append the following to the file "/etc/services": rquotad 4004/tcp # rpc.rquotad tcp port rquotad 4004/udp # rpc.rquotad udp port 3. Restart the nfs services: /etc/init.d/nfs restart /etc/init.d/nfslock restart 4. Run /usr/sbin/rpcinfo -p and make sure the ports above have changed. 5. Add a custom protocol in the advanced tab of guarddog for ports 4001-4004, for both udp and tcp. Enable these protocols. In the end, these ports should be open: 111:tcp, 111:udp, 2049:tcp, 2049:udp, 4001:tcp, 4001:udp, 4002:tcp, 4002:udp, 4003:tcp, 4003:udp, 4004:tcp, 4004:udp This works for me (on Fedora Core 4) - after much painful research! - Mike ------------------------------------------------------- SF.Net email is Sponsored by the Better Software Conference & EXPO September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf