AMRLers,
I succeeded in getting NFS crossmounting to work with Linux IP tables.
Thanks to Bill Gurley, Keith Brown, Dave Scott, and Bruker for suggestions.
Gory details are below for those interested.
Some useful websites:
http://www.justlinux.com/nhf/Security/IPtables_Basics.html
http://yolinux.com/TUTORIALS/LinuxTutorialIptablesNetworkGateway.html
http://www.knowplace.org/netfilter/syntax.html
http://www.lowth.com/LinWiz/nfs_help.html
The last one contained details of how to convince NFS to work with a
firewall.
As with Perl programming, there are many ways to set up the iptables. I
went for the ban everything and turn on just what is needed. So far,
everything I care about works. Some services occur on specific ports
(like ssh or telnet). These are easy. Some services (like NFS) change
ports at every reboot. These are tougher, The technique used in the
website above (lowth.com) is to fix these so they can't change. NFS
itself doesn't change, but rpc.mounted and rpc.locked do.
/usr/sbin/rpcinfo -p will list the ports in current use
rpc.mounted is locked by editing /etc/sysconfig/nfs to include the line:
MOUNTD_PORT=<b number>
rpc.lockd is locked by editing /etc/modules.conf to include the line:
options lockd nlm_udpport=<a number> nlm_tcpport=<a number>
Finally, I have one system that doesn't do ssh, so I need to allow
telent from it. /etc/xinetd.d/krb5-telnet was edited and these lines
changed or added:
disable = no
only_from = <ip address of my telnet only computer>
My final /etc/sysconfig/iptables file:
# Generated by iptables-save v1.2.8
*filter
# Drop everything and add later
:INPUT DROP [91:10469]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [78155:16051660]
:RH-Firewall-1-INPUT - [0:0]
# Allow self connections- necessary for computer to work!
-A INPUT -i lo -j ACCEPT
# Allow connections to the spectrometer
-A INPUT -i eth1 -j ACCEPT
# Allow established connections
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow ssh/telnet from trusted hosts
# port 22 is ssh/sftp port 23 is telnet
-A INPUT -s <ip of system 1> -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s <ip of system 1> -p udp -m udp --dport 22 -j ACCEPT
-A INPUT -s <ip of system 2> -p tcp -m tcp --dport 23 -j ACCEPT
A INPUT -s <ip of system 2> -p udp -m udp --dport 23 -j ACCEPT
# Turn on nfs for file sharing
#2049 is standard for NFS
-A INPUT -s <ip of data station> -p udp -m udp --dport 2049 -j ACCEPT
-A INPUT -s <ip of data station> -p tcp -m tcp --dport 2049 -j ACCEPT
# Turn on portmapper for file sharing
#111 is standard for portmapper
-A INPUT -s <ip of data station> -p udp -m udp --dport 111 -j ACCEPT
-A INPUT -s <ip of data station> -p tcp -m tcp --dport 111 -j ACCEPT
# Turn on nfs lock manager for file sharing
# port locked in edit /etc/modules.conf
-A INPUT -s <ip data station> -p udp -m udp --dport <a number> -j ACCEPT
-A INPUT -s <ip data station> -p tcp -m tcp --dport <a number> -j ACCEPT
# Turn on mountd for file sharing
# Note: port locked in /etc/sysconfig/nfs
-A INPUT -s <ip data station> -p udp -m udp --dport <b number> -j ACCEPT
-A INPUT -s <ip data sttion> -p tcp -m tcp --dport <b number > -j ACCEPT
# Necessary for connection to VT unit
-A INPUT -p esp -j ACCEPT
-A INPUT -p ah -j ACCEPT
# For completness
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o eth1 -j ACCEPT
COMMIT
# Completed
--
Karen Ann Smith karenann_at_unm.edu
Director, NMR Facility Adj. Asst. Prof.
Dept. of Chemistry Clark Hall MSC03 2060
University of New Mexico Albuquerque, NM 87131-0001
505.277.4031 url: http://www.unm.edu/~karenann
Out of this world screensaver: http://setiathome.ssl.berkeley.edu
To have no errors
Would be life without meaning
No struggle, no joy.
Received on Thu Sep 01 2005 - 13:07:27 MST