Re: NFS connection dropped

Hi Michael, hi list,

thanks for your help.
Dr. Michael J. Chudobiak wrote (1.9.2005, 22:45):
> Port 1025 is the problem in the above log. Its being blocked, not
> 111. However, the ports used by NFS are usually NOT static. It might
> be 1025 today, 9999 tomorrow. You have to "pin" the NFS ports, and
> open the firewall for them. To do this:

OK, so if the protocol is allowed then the guarddog's log message could 
point either on a SPT or DPT problem, right? What I mean is that a 
connection might be refused because a) the protocol is not permitted, 
b) the source port the connection is coming from is not allowed or c) 
the destination port the connection is trying to connect to is not 
allowed. Which one is the _real_ reason for dropping the connection 
cannot be extracted from the log message - this makes error-tracking a 
little bit tricky...

To Mike's suggestions:
> 1. Create the file "/etc/sysconfig/nfs" and add the following
> contents:
>
> STATD_PORT=4001
> LOCKD_TCPPORT=4002
> LOCKD_UDPPORT=4002
> MOUNTD_PORT=4003

This makes the nfs and mountd ports to be static instead of being 
dynamically set, right?

But, in my /etc/services the nfs (tcp/udp) is connected to 2049, mountd 
to 763 and the following lines exist, too:
terabase        4000/tcp   # Terabase
terabase        4000/udp   # Terabase
newoak          4001/tcp   # NewOak
newoak          4001/udp   # NewOak
pxc-spvr-ft     4002/tcp   # pxc-spvr-ft
pxc-spvr-ft     4002/udp   # pxc-spvr-ft
pxc-splr-ft     4003/tcp   # pxc-splr-ft
pxc-splr-ft     4003/udp   # pxc-splr-ft
pxc-roid        4004/tcp   # pxc-roid
pxc-roid        4004/udp   # pxc-roid

Do I see a problem here??

> 2. Append the following to the file "/etc/services":
>
> rquotad 4004/tcp # rpc.rquotad tcp port
> rquotad 4004/udp # rpc.rquotad udp port

This is _not_ clear to me (see above, too). Does it have somthing to do 
with quota and if so, why on earth should it be enabled?? AFAIK, quota 
is not needed by nfs.

...
>
>
> This works for me (on Fedora Core 4) - after much painful research!
>

Painful or not, but I think this should be fixed in the next release of 
guarddog. If one enables the "nfs" protocol she/he should be sure 
everything will work without any futher "hacking". Now I have been 
forced to use my usb-stick in order to sync data between my PC and 
laptop. Maybe Simon could take a look how SuSE firewall (also based on 
iptables) is configured when nfs-server is enabled? There is a 
possibility to adjust the SuSE firewall's (not Guarddog's) settings 
when nfs-server is enabled. 

But in general, Guaddog _is_ a very good software (and much more 
flexible than SuSE FW). Many thanks for it!

Kind regards
Kimmo


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf