Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a situation where I need to mount a few NFS shares on a series of clients on replicated VM networks. So their source IP addresses are not unique. In between the client and the server there is a routing linux vm, which can do all sorts of things as deemed appropriate. I'm really unsure how best to approach making these shares reachable...

1 - fully route traffic end to end, with an iptables masquerade on the "router" to source nat all client traffic 2 - do masq AND dnat on the router, making the internal machines think they are going to the "router" for NFS - this makes routing tables much simpler as everything then appears to be local. Maybe using a secondary IP on the "router" for clarity with all the NFS ports in use. 3 - mount and then re-export nfs on the "router" vm. This feels really bad, but would give extra control to only allow certain mounts to be mounted by certain clients. As above, any NAT solution means all end clients look to be the same under NFSv3, which could cause security concerns. This also makes the routing tables a non issue. I think I saw comment that performance would significantly drop this way...

Any other options / thoughts gratefully appreciated.

Thanks

Chris

share|improve this question

1 Answer 1

I believe NFS clients behind a NAT should work just fine without any special gimmicks. You might have problems if you want to do RPC_GSS (Kerberos authentication), since the server will be checking the client's ip address against its host principal, but if you're just doing AUTH_SYS I don't see any reason why it wouldn't work.

share|improve this answer
    
I don't doubt any of the solutions would work, it's that I'm looking for the best solution. Ideally I don't want my clients to know anything about the NFS server itself, as this needs to be able to drop into different locations with different subnets on the NFS server side, but always the same on the client. –  Chris Phillips Feb 12 '11 at 13:57
    
If these are VMs you might mount the filesystems on the hosts and present them up to the guests. Best in what way? It sounds like you want an NFS client to have a static config, but why not just change the server location in DNS? Your original question was ambiguous and I read "how to make them reachable". –  beans Feb 12 '11 at 14:06
    
our build systems don't fit with additional block device configuration, only a basic OS disk is required, all other inputs need to come over IP. DNS is fine, and if we need to route end to end that would be part of the solution, but our security guys like not having single connections spanning these networks as a first pass. –  Chris Phillips Feb 12 '11 at 21:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.