How do I enable NFS mounts/shares with iptables with DROP policy?
NFS uses dynamically assigned ports, thus it is difficult to use with firewalls. I have an NFS server and a few clients. I would like to accept traffic ONLY on ports that are required for NFS to work. I have configured the NFS server to use static ports (4000-4004).
The problem, however, is that the clients still selects a random port -- and because it is UDP I can only make it work if I accept all UDP traffic from the server.
I found some documentation that describes setting a /sys variable that would limit the client to use a static range of ports for NFS, however, I cannot seem to make it work. The /sys variables mentioned are:
/sys/module/sunrpc/parameters/max_resvport
/sys/module/sunrpc/parameters/min_resvport
/sys/module/lockd/parameters/nlm_tcpport
/sys/module/lockd/parameters/nlm_udpport
/sys/module/nfs/parameters/callback_tcpport
I have not been able to make this work. Maybe I am approaching this the wrong way? It seems unnecessarily complicated for what I thought would be a simple task.
I use NFS on Debian and Ubuntu.