Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running Ubuntu 11.10 - setting up NFS to share a directory among many other servers. Which ports are required to be opened on the firewall?

share|improve this question
add comment

4 Answers

up vote 15 down vote accepted

rpcinfo -p | grep nfs

Port 111 (TCP and UDP) and 2049 (TCP and UDP) for the NFS server.

There are also ports for Cluster and client status (Port 1110 TCP for the former, and 1110 UDP for the latter) as well as a port for the NFS lock manager (Port 4045 TCP and UDP). Only you can determine which ports you need to allow depending on which services are needed cross-gateway.

share|improve this answer
    
I did not know about rpcinfo, that is quite useful. I didn't see the port 111 with the grep nfs, but I left off the grep to learn that 111 is for portmapper. Also good to know! (and like you mentioned, necessary) –  kenny Apr 5 '12 at 21:12
    
@KennyYounger rpcinfo is a useful too. If this answered your question, don't forget to mark it as the answer for the benefit of future viewers. –  Wesley Apr 5 '12 at 21:17
2  
You need mountd open when you first mount the filesystem. It runs on a dynamic port, so it won't always be the same. I put a link to a guide in my answer. –  bonsaiviking Apr 5 '12 at 21:23
    
@bonsaiviking Excellent! Thank you. –  Wesley Apr 5 '12 at 21:33
    
Thanks @bonsaiviking. Critical info for this process. I upvoted your answer! –  kenny Apr 6 '12 at 0:25
add comment

In addition to 111 for portmapper and 2049 for nfs, you will need to allow the mountd port and possibly rquotad, lockd, and statd, all of which can be dynamic. This excellent NFS security guide recommends changing your startup scripts and kernel module configs to force them to use static ports.

In addition to the guide above, which has a section on firewalls, see my answer to another question about hardening NFS.

share|improve this answer
2  
We really do prefer content, not pointers to content. A précis of the content with a link is ok too and preferred to a link. –  Iain Apr 5 '12 at 21:31
add comment

With FERM one can use Backticks to get the ports from rpcinfo, for example:

Server:

proto tcp {saddr ($CLIENT) {
  dport (`rpcinfo -p | perl -e 'while(<>){/\s+\d+\s+\d\s+(?:tcp)\s+(\d+)/ and $ports{$1}=1}; $, = " "; print sort(keys(%ports)),"\n"'`) ACCEPT; # NFS
}}
proto udp {saddr ($CLIENT) {
  dport (`rpcinfo -p | perl -e 'while(<>){/\s+\d+\s+\d\s+(?:udp)\s+(\d+)/ and $ports{$1}=1}; $, = " "; print sort(keys(%ports)),"\n"'`) ACCEPT; # NFS
}}

Client:

proto udp {saddr ($SERVER) {ACCEPT;}}  # NFS

(If you're only going to use the TCP then you need only the proto tcp part).

share|improve this answer
add comment

Check out the services file under the /etc directory, This file con information about service, port type and number

Sathish ~ # cat /etc/services | grep -i nfs
nfs     2049/tcp            # Network File System
nfs     2049/udp            # Network File System
share|improve this answer
    
/etc/services does not contain enough information to construct a firewall policy which blocks unwanted traffic, but allows all necessary NFS traffic –  Felipe Alvarez Nov 15 '13 at 1:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.