I have an Ubuntu 11.10 system with an iptables firewall. After pinning the ports for mountd, lockd and statd, then opening them up in iptables, I am able to expose NFS shares through the firewall with no issues.
What I am having a problem with is mounting a share from another NFS server that I have no control over. If I disable the firewall, I can mount the share. I can also mount other NFS shares without disabling the firewall.
So that leads me to two questions:
- Why would a firewall prevent an NFS client from mounting some servers and not others?
- Can a client specify ports to use for an NFS mount?
Full config and error info:
The server is NFSv3 according to nfsstat
. When I do the mount:
# mount -t nfs -v 192.168.80.48:/location /mnt/tmp
mount.nfs: timeout set for Fri Mar 23 09:13:00 2012
mount.nfs: trying text-based options 'vers=4,addr=192.168.80.48,clientaddr=192.168.40.173'
mount.nfs: mount(2): No such file or directory
mount.nfs: trying text-based options 'addr=192.168.80.48'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: trying 192.168.80.48 prog 100003 vers 3 prot TCP port 2049
mount.nfs: prog 100005, trying vers=3, prot=17
mount.nfs: trying 192.168.80.48 prog 100005 vers 3 prot UDP port 678
mount.nfs: portmap query retrying: RPC: Timed out
mount.nfs: prog 100005, trying vers=3, prot=6
mount.nfs: trying 192.168.80.48 prog 100005 vers 3 prot TCP port 681
mount.nfs: portmap query failed: RPC: Remote system error - Connection timed out
I see the packets being dropped:
Rejected packets: SRC=192.168.80.48 DST=192.168.40.173 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=681 DPT=40325 WINDOW=5792 RES=0x00 ACK SYN URGP=0
Rejected packets: SRC=192.168.80.48 DST=192.168.40.173 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=681 DPT=47419 WINDOW=5792 RES=0x00 ACK SYN URGP=0
Rejected packets: SRC=192.168.80.48 DST=192.168.40.173 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=681 DPT=41238 WINDOW=5792 RES=0x00 ACK SYN URGP=0
showmount
fails in the same way. From the verbose mount
prints, it looks like portmap is the issue, but I do have that opened.
# rpcinfo -p
program vers proto port service
100000 4 tcp 111 portmapper
100000 3 tcp 111 portmapper
100000 2 tcp 111 portmapper
100000 4 udp 111 portmapper
100000 3 udp 111 portmapper
100000 2 udp 111 portmapper
100024 1 udp 32765 status
100024 1 tcp 32765 status
100003 2 tcp 2049 nfs
100003 3 tcp 2049 nfs
100003 4 tcp 2049 nfs
100227 2 tcp 2049
100227 3 tcp 2049
100003 2 udp 2049 nfs
100003 3 udp 2049 nfs
100003 4 udp 2049 nfs
100227 2 udp 2049
100227 3 udp 2049
100021 1 udp 4002 nlockmgr
100021 3 udp 4002 nlockmgr
100021 4 udp 4002 nlockmgr
100021 1 tcp 4001 nlockmgr
100021 3 tcp 4001 nlockmgr
100021 4 tcp 4001 nlockmgr
100005 1 udp 32767 mountd
100005 1 tcp 32767 mountd
100005 2 udp 32767 mountd
100005 2 tcp 32767 mountd
100005 3 udp 32767 mountd
100005 3 tcp 32767 mountd
# cat /etc/services
sunrpc 111/tcp portmapper # RPC 4.0 portmapper
sunrpc 111/udp portmapper
nfs 2049/tcp # Network File System
nfs 2049/udp # Network File System
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:smtp
ACCEPT tcp -- anywhere anywhere tcp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:sunrpc
ACCEPT tcp -- anywhere anywhere tcp dpt:ntp
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ns
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-dgm
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ssn
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT tcp -- anywhere anywhere tcp dpt:microsoft-ds
ACCEPT tcp -- anywhere anywhere tcp dpt:nfs
ACCEPT tcp -- anywhere anywhere tcp dpt:sunrpc
ACCEPT tcp -- anywhere anywhere tcp dpt:3260
ACCEPT tcp -- anywhere anywhere tcp dpt:32765
ACCEPT tcp -- anywhere anywhere tcp dpt:32766
ACCEPT tcp -- anywhere anywhere tcp dpt:32767
ACCEPT tcp -- anywhere anywhere tcp dpt:4001
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:sunrpc
ACCEPT udp -- anywhere anywhere udp dpt:ntp
ACCEPT udp -- anywhere anywhere udp dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp dpt:netbios-dgm
ACCEPT udp -- anywhere anywhere udp dpt:netbios-ssn
ACCEPT udp -- anywhere anywhere udp dpt:https
ACCEPT udp -- anywhere anywhere udp dpt:microsoft-ds
ACCEPT udp -- anywhere anywhere udp dpt:nfs
ACCEPT udp -- anywhere anywhere udp dpt:4002
ACCEPT udp -- anywhere anywhere udp dpt:32765
ACCEPT udp -- anywhere anywhere udp dpt:32766
ACCEPT udp -- anywhere anywhere udp dpt:32767
ACCEPT tcp -- anywhere anywhere tcp spt:domain
ACCEPT udp -- anywhere anywhere udp spt:domain
ACCEPT tcp -- anywhere anywhere tcp spt:sunrpc
ACCEPT udp -- anywhere anywhere udp spt:sunrpc
ACCEPT tcp -- anywhere anywhere tcp spt:netbios-ssn
ACCEPT udp -- anywhere anywhere udp spt:netbios-ssn
ACCEPT tcp -- anywhere anywhere tcp spt:https
ACCEPT udp -- anywhere anywhere udp spt:https
ACCEPT tcp -- anywhere anywhere tcp spt:microsoft-ds
ACCEPT udp -- anywhere anywhere udp spt:microsoft-ds
ACCEPT tcp -- anywhere anywhere tcp spt:submission
ACCEPT udp -- anywhere anywhere udp spt:submission
ACCEPT tcp -- anywhere anywhere tcp spt:nfs
ACCEPT udp -- anywhere anywhere udp spt:nfs