1

This question has been asked here before but has conflicting and possibly outdated answers. It seems to depend on OS, version of OS, and version of NFS.

On a CentOS 6.5 server, the default rules are similar to:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [47:3512]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -j REJECT --reject-with icmp-host-prohibited 
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

The server seems to support both NFS version 3 and version 4. I'm gathering from other answers that V4 is simpler to configure a firewall with, because it doesn't use ports picked at random. All of the clients are Mint 16, which I assume can use NFS v4 as well.

Some sources say that I only need ports 111 and 2049 with NFS v4, IF I'm "only using TCP", which I am unsure of. (How do I know?) Assuming all NFSv4 is TCP, I would only have to add:

-A INPUT -p tcp -m state --state NEW -m tcp --dport 111 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2049 -j ACCEPT
  1. Is this correct?
  2. Is there any thing else that needs to be done, such as disabling NFS v3 mode?
2

0

You must log in to answer this question.

Browse other questions tagged .