Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
Running NFS with iptables, change firewall?

I need to allow a client to connect to a nfs server. If I disable iptables then NFS works great.

I understand that when NFS starts it'll fire up RPCNFSDCOUNT (/etc/default/nfs-kernel-server) processes that all are running on a different port.

How do I specify what ports those are so that they always fire up on the same port?

Presumably I need to open up 111 for UDP and TCP traffic. What about the NFS ports? 2049? UDP/TCP? The other ports?

Ubuntu-specific answers would be appreciated.

share|improve this question

marked as duplicate by mailq, Iain, MadHatter, MDMarra, voretaq7 Nov 21 '11 at 16:02

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

If you using just TCP with NFS4, ports 111 and 2049 will do. If you are planning to have NFS3 and below for compatibility reasons, you need to open ports for within the following:

RQUOTA
LOCKD
MOUNTD
STATD

However, you will need to explicitly set static ports for those domains, otherwise they will use random ports by default, which will cause issues for NFSv2/3 clients. Here is a link for specifying the ports on Ubuntu:

https://wiki.ubuntu.com/How%20to%20get%20NFS%20working%20with%20Ubuntu-CE-Firewall

(For some reason, it is harder to do on Ubuntu than on Red Hat, as most of the links I found are for Red Hat. If I find something better, I'll post an update)

EDIT: Here is a better one - this is from Debian, which Ubuntu is based on:

http://wiki.debian.org/SecuringNFS

Also, in that article, go to this link:

http://www.tldp.org/HOWTO/NFS-HOWTO/security.html

share|improve this answer
    
I would use NFS4, but I'm on the latest ubuntu server and $ nfsstat is showing v3. –  crankharder Sep 19 '11 at 23:27
    
Then you definitely need to explicitly set ports for the above daemons. –  Rilindo Sep 19 '11 at 23:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.