Wish I could say I could get this to work with this info.
Can connect to nfs when firewall down, but not when up.
I have a stock dansgui install on Karmic.
Here is a "proof" of what I have changed:
$ grep -i rpcmountdopts= /etc/init.d/nfs-kernel-server
RPCMOUNTDOPTS="-p 32771"
RPCMOUNTDOPTS="$RPCMOUNTDOPTS --no-nfs-version 3"
$ rpcinfo -p
program vers proto port
100000 2 tcp 111 portmapper
100000 2 udp 111 portmapper
100024 1 udp 58448 status
100024 1 tcp 57974 status
100021 1 udp 4045 nlockmgr
100021 3 udp 4045 nlockmgr
100021 4 udp 4045 nlockmgr
100021 1 tcp 4045 nlockmgr
100021 3 tcp 4045 nlockmgr
100021 4 tcp 4045 nlockmgr
100003 2 udp 2049 nfs
100003 3 udp 2049 nfs
100003 4 udp 2049 nfs
100003 2 tcp 2049 nfs
100003 3 tcp 2049 nfs
100003 4 tcp 2049 nfs
100005 1 udp 48163 mountd
100005 1 tcp 33296 mountd
100005 2 udp 48163 mountd
100005 2 tcp 33296 mountd
100005 3 udp 48163 mountd
100005 3 tcp 33296 mountd
$ nmap localhost
Starting Nmap 5.00 ( http://nmap.org ) at 2010-04-02 21:28 CDT
Interesting ports on localhost (127.0.0.1):
Not shown: 993 closed ports
PORT STATE SERVICE
111/tcp open rpcbind
631/tcp open ipp
2049/tcp open nfs
3128/tcp open squid-http
4045/tcp open lockd
5900/tcp open vnc
8080/tcp open http-proxy
$ sudo iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:50505 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:www state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:smtp state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:sunrpc state NEW
ACCEPT udp -- anywhere anywhere udp dpt:sunrpc state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:nfs state NEW
ACCEPT udp -- anywhere anywhere udp dpt:nfs state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:4045 state NEW
ACCEPT udp -- anywhere anywhere udp dpt:4045 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:32771 state NEW
ACCEPT udp -- anywhere anywhere udp dpt:32771 state NEW
ACCEPT icmp -- anywhere anywhere
DROP all -- anywhere 0.0.0.255/0.0.0.255
DROP all -- anywhere ALL-SYSTEMS.MCAST.NET
LOG all -- anywhere anywhere LOG level warning
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
$ cat /etc/init.d/ubuntu_ce_firewall
#!/bin/bash
### BEGIN INIT INFO
# Provides: ubuntu_ce_firewall
# Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: firewall
# Description: Start, stop or reload firewall.
### END INIT INFO
set -e
case "$1" in
start)
echo -e "\nStarting Ubuntu CE firewall .....\n"
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -A POSTROUTING -t nat -o lo -p tcp --dport 8080 -j SNAT --to 127.0.0.1
iptables -A OUTPUT -t nat ! -d 127.0.0.1 -p tcp --dport 80 -m owner ! --uid-owner root -j REDIRECT --to-ports 8080
iptables -P INPUT DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
## Open port for ssh server (22), web server (80), and mail server (25)
iptables -A INPUT -p tcp --dport 50505 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -m state --state NEW -j ACCEPT
## Uncomment below to open NSF port, edit the port accoring actual setting
iptables -A INPUT -p tcp --dport 111 -m state --state NEW -j ACCEPT
iptables -A INPUT -p udp --dport 111 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 2049 -m state --state NEW -j ACCEPT
iptables -A INPUT -p udp --dport 2049 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 4045 -m state --state NEW -j ACCEPT
iptables -A INPUT -p udp --dport 4045 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 32771 -m state --state NEW -j ACCEPT
iptables -A INPUT -p udp --dport 32771 -m state --state NEW -j ACCEPT
## Open ports for NSF end
#Accept Ping request
iptables -A INPUT -p icmp -j ACCEPT
# Drop other packets, Logging, and closing firewall.
iptables -A INPUT -d 255.255.255.255/0.0.0.255 -j DROP
iptables -A INPUT -d 224.0.0.1 -j DROP
iptables -A INPUT -j LOG
iptables -A INPUT -j REJECT
;;
stop)
echo -e "\nFlushing firewall and setting default policies to ACCEPT\n"
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
;;
status)
iptables -L
;;
restart|force-reload)
$0 stop
$0 start
;;
*)
echo "Usage: /etc/init.d/ubuntu_ce_firewall {start|stop|restart|force-reload|status}"
exit 1
;;
esac
**FROM CLIENT COMPUTER**
$ nmap luke-netbook
Starting Nmap 5.00 ( http://nmap.org ) at 2010-04-02 21:29 CDT
Interesting ports on luke-netbook (192.168.1.62):
Not shown: 994 filtered ports
PORT STATE SERVICE
25/tcp closed smtp
80/tcp closed http
111/tcp open rpcbind
2049/tcp open nfs
4045/tcp open lockd
32771/tcp closed sometimes-rpc5
MAC Address: 0C:60:76:46:8A:3C (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 38.37 seconds
The closed 32771 has me puzzled. I only got this once. On running it with the same command, I get nothing about 32771, however with:
sudo nmap -PN -p 32771 192.168.1.62
Starting Nmap 5.00 ( http://nmap.org ) at 2010-04-02 22:11 CDT
Interesting ports on luke-netbook (192.168.1.62):
PORT STATE SERVICE
32771/tcp closed sometimes-rpc5
MAC Address: 0C:60:76:46:8A:3C (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 0.44 seconds
which shows the 32771 closed but as above from the excerpt from aboves ubuntu_ce_firewall 32771 should be open.
iptables -A INPUT -p tcp --dport 32771 -m state --state NEW -j ACCEPT
iptables -A INPUT -p udp --dport 32771 -m state --state NEW -j ACCEPT
I also tried this with port 32767 (which shouldn't matter) and it didn't matter. Still no nfs with firewall up.
Would someone please give me guidance?
With thanks, Narnie