NFS server ports ? - Debian

This is a discussion on NFS server ports ? - Debian ; Hi I am running an NFS server but have not been able to find which ports need to be open for the server to be available to clients. rpcinfo -p indicates : program vers proto port 100000 2 tcp 111 ...

+ Reply to Thread
Results 1 to 7 of 7

Thread: NFS server ports ?

  1. NFS server ports ?

    Hi

    I am running an NFS server but have not been able to find which ports need
    to be open for the server to be available to clients.

    rpcinfo -p indicates :

    program vers proto port
    100000 2 tcp 111 portmapper
    100000 2 udp 111 portmapper
    100024 1 udp 940 status
    100024 1 tcp 943 status
    100003 2 udp 2049 nfs
    100003 2 tcp 2049 nfs
    100005 1 udp 980 mountd
    100005 2 udp 980 mountd
    100005 1 tcp 983 mountd
    100005 2 tcp 983 mountd

    I have tried opening all the ports above, but unless I drop the firewall
    completely, clients are unable to access it.

    Thanks.

  2. Re: NFS server ports ?

    "Madhusudan Singh" wrote in message
    news:4374db22$0$41140$14726298@news.sunsite.dk

    > I am running an NFS server but have not been able to find which ports
    > need to be open for the server to be available to clients.
    >
    > rpcinfo -p indicates :
    > program vers proto port

    ....
    > 100003 2 udp 2049 nfs
    > 100003 2 tcp 2049 nfs

    ....

    $ grep nfs /etc/services
    nfs 2049/tcp nfsd
    nfs 2049/udp nfsd

    > I have tried opening all the ports above, but unless I drop the
    > firewall completely, clients are unable to access it.


    That seems to indicate that the tcp/udp port 2049 is either not open then,
    or else you have failed to enable "/sbin/iptables -A INPUT -m state --state
    ESTABLISHED,RELATED -j ACCEPT" assuming you are using netfilter as firewall.


  3. Re: NFS server ports ?

    Madhusudan Singh told us in 'linux.redhat':

    > Hi
    >
    > I am running an NFS server but have not been able to find which ports need
    > to be open for the server to be available to clients.
    >
    > rpcinfo -p indicates :
    >
    > program vers proto port
    > 100000 2 tcp 111 portmapper
    > 100000 2 udp 111 portmapper
    > 100024 1 udp 940 status
    > 100024 1 tcp 943 status
    > 100003 2 udp 2049 nfs
    > 100003 2 tcp 2049 nfs
    > 100005 1 udp 980 mountd
    > 100005 2 udp 980 mountd
    > 100005 1 tcp 983 mountd
    > 100005 2 tcp 983 mountd
    >
    > I have tried opening all the ports above, but unless I drop the firewall
    > completely, clients are unable to access it.
    >
    > Thanks.


    some ports are generated randomly. So you have to set up NFS to use fix
    ports. Start looking at:

    http://www.lowth.com/LinWiz/nfs_help.html


    tx

  4. Re: NFS server ports ?

    On Fri, 11 Nov 2005 07:57:29 -0500, Madhusudan Singh
    wrote:

    >Hi
    >
    >I am running an NFS server but have not been able to find which ports need
    >to be open for the server to be available to clients.
    >
    >rpcinfo -p indicates :
    >
    > program vers proto port
    > 100000 2 tcp 111 portmapper
    > 100000 2 udp 111 portmapper
    > 100024 1 udp 940 status
    > 100024 1 tcp 943 status
    > 100003 2 udp 2049 nfs
    > 100003 2 tcp 2049 nfs
    > 100005 1 udp 980 mountd
    > 100005 2 udp 980 mountd
    > 100005 1 tcp 983 mountd
    > 100005 2 tcp 983 mountd
    >
    >I have tried opening all the ports above, but unless I drop the firewall
    >completely, clients are unable to access it.
    >
    >Thanks.


    Check the logs for any hints, and setup a sniffer like ethereal, run
    it, and see what's going on.

    MT

  5. Re: NFS server ports ?

    On Fri, 11 Nov 2005 07:57:29 -0500, Madhusudan Singh wrote:

    > Hi
    >
    > I am running an NFS server but have not been able to find which ports need
    > to be open for the server to be available to clients.
    >
    > rpcinfo -p indicates :
    >
    > program vers proto port
    > 100000 2 tcp 111 portmapper
    > 100000 2 udp 111 portmapper
    > 100024 1 udp 940 status
    > 100024 1 tcp 943 status
    > 100003 2 udp 2049 nfs
    > 100003 2 tcp 2049 nfs
    > 100005 1 udp 980 mountd
    > 100005 2 udp 980 mountd
    > 100005 1 tcp 983 mountd
    > 100005 2 tcp 983 mountd
    >
    > I have tried opening all the ports above, but unless I drop the firewall
    > completely, clients are unable to access it.
    >
    > Thanks.


    Turn off the firewall on the server, and it should work. Of course, you
    want to do nfs with a firewall, and things get a little tricker.

    nfs always runs on port 2049 tcp,udp, and portmap runs on 111.
    However, rpc.mountd, rpc.statd, rpc.lockd, rpc, rpc.quotad are at the
    mercy of the portmapper, and run on random ports. This is ok if
    there is no firewall on the nfs server.

    With a firewall, you need to open the ports on which the rpc services
    run, so the rpc services must be bound to fixed ports. To this end,
    notice that (on FC and probably other RH)

    (a) nfs and all rpc's except rpc.statd are started by
    /etc/rc.d/init.d/nfs

    (b) rpc.statd/rpc.lockd are started by /etc/rc.d/init.d/nfslock

    (c) both .../nfslock and .../nfs source /etc/sysconfig/nfs to
    read some variables, which can include what ports to run the services
    on.


    So on the server force the rpc services to start on whatever ports you
    want by editing /etc/sysconfig/nfs:

    > more /etc/sysconfig/nfs

    STATD_PORT=4000
    LOCKD_TCPPORT=4001
    LOCKD_UDPPORT=4001
    MOUNTD_PORT=4002
    RQUOTAD_PORT=4003


    Now that you know which ports you can expect the rpc's to run on, put
    these rules in /etc/sysconfig/iptables to open the nfs ports on
    the server:

    -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2049 -j ACCEPT
    -A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 2049 -j ACCEPT
    -A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 111 -j ACCEPT
    -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 111 -j ACCEPT
    -A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 4000:4003 -j ACCEPT
    -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 4000:4003 -j ACCEPT



  6. Re: NFS server ports ?

    Amadeus W. M. wrote:

    > On Fri, 11 Nov 2005 07:57:29 -0500, Madhusudan Singh wrote:
    >
    >> Hi
    >>
    >> I am running an NFS server but have not been able to find which ports
    >> need to be open for the server to be available to clients.
    >>
    >> rpcinfo -p indicates :
    >>
    >> program vers proto port
    >> 100000 2 tcp 111 portmapper
    >> 100000 2 udp 111 portmapper
    >> 100024 1 udp 940 status
    >> 100024 1 tcp 943 status
    >> 100003 2 udp 2049 nfs
    >> 100003 2 tcp 2049 nfs
    >> 100005 1 udp 980 mountd
    >> 100005 2 udp 980 mountd
    >> 100005 1 tcp 983 mountd
    >> 100005 2 tcp 983 mountd
    >>
    >> I have tried opening all the ports above, but unless I drop the firewall
    >> completely, clients are unable to access it.
    >>
    >> Thanks.

    >
    > Turn off the firewall on the server, and it should work. Of course, you
    > want to do nfs with a firewall, and things get a little tricker.
    >
    > nfs always runs on port 2049 tcp,udp, and portmap runs on 111.
    > However, rpc.mountd, rpc.statd, rpc.lockd, rpc, rpc.quotad are at the
    > mercy of the portmapper, and run on random ports. This is ok if
    > there is no firewall on the nfs server.
    >
    > With a firewall, you need to open the ports on which the rpc services
    > run, so the rpc services must be bound to fixed ports. To this end,
    > notice that (on FC and probably other RH)
    >
    > (a) nfs and all rpc's except rpc.statd are started by
    > /etc/rc.d/init.d/nfs
    >
    > (b) rpc.statd/rpc.lockd are started by /etc/rc.d/init.d/nfslock
    >
    > (c) both .../nfslock and .../nfs source /etc/sysconfig/nfs to
    > read some variables, which can include what ports to run the services
    > on.
    >
    >
    > So on the server force the rpc services to start on whatever ports you
    > want by editing /etc/sysconfig/nfs:
    >
    >> more /etc/sysconfig/nfs

    > STATD_PORT=4000
    > LOCKD_TCPPORT=4001
    > LOCKD_UDPPORT=4001
    > MOUNTD_PORT=4002
    > RQUOTAD_PORT=4003
    >
    >
    > Now that you know which ports you can expect the rpc's to run on, put
    > these rules in /etc/sysconfig/iptables to open the nfs ports on
    > the server:
    >
    > -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2049 -j
    > ACCEPT -A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport
    > 2049 -j ACCEPT -A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp
    > --dport 111 -j ACCEPT -A RH-Firewall-1-INPUT -p tcp -m state --state NEW
    > -m tcp --dport 111 -j ACCEPT -A RH-Firewall-1-INPUT -p udp -m state
    > --state NEW -m udp --dport 4000:4003 -j ACCEPT -A RH-Firewall-1-INPUT -p
    > tcp -m state --state NEW -m tcp --dport 4000:4003 -j ACCEPT


    Many thanks for your hints, but your instructions seem to be very RH
    specific. I am using Debian.

  7. Re: NFS server ports ?

    tx wrote:

    > Madhusudan Singh told us in
    > 'linux.redhat':
    >
    >> Hi
    >>
    >> I am running an NFS server but have not been able to find which ports
    >> need to be open for the server to be available to clients.
    >>
    >> rpcinfo -p indicates :
    >>
    >> program vers proto port
    >> 100000 2 tcp 111 portmapper
    >> 100000 2 udp 111 portmapper
    >> 100024 1 udp 940 status
    >> 100024 1 tcp 943 status
    >> 100003 2 udp 2049 nfs
    >> 100003 2 tcp 2049 nfs
    >> 100005 1 udp 980 mountd
    >> 100005 2 udp 980 mountd
    >> 100005 1 tcp 983 mountd
    >> 100005 2 tcp 983 mountd
    >>
    >> I have tried opening all the ports above, but unless I drop the firewall
    >> completely, clients are unable to access it.
    >>
    >> Thanks.

    >
    > some ports are generated randomly. So you have to set up NFS to use fix
    > ports. Start looking at:
    >
    > http://www.lowth.com/LinWiz/nfs_help.html
    >
    >
    > tx


    Very RH specific. Any links that are a little more general would be welcome.
    Thanks.

+ Reply to Thread