NFS daemon depends on portmapper which allocates random port to the nfs related daemons statd, mountd, lockd, and rquotad. Due to random allocation of ports (beside 2049/tcp,udp; 111/portmapper-sunrpc/tcp,udp) it's not straight forward to have NFS server behind a firewall.
However with new nfs-utils versions we can bind mountd,stad,lockd,rquotad to certain port numbers, on redhat we can define port numbers in /etc/sysconfig/nfs file and then simple iptables rules. For example, after modifying /etc/sysconfig/nfs I have
RQUOTAD_PORT=875
LOCKD_TCPPORT=32803
LOCKD_UDPPORT=32769
MOUNTD_PORT=892
Other ports which needs to be opened on firewall are 111/tcp,udp for portmapper and 2049/tcp,udp for nfsd.
However this is not available with older version of nfs-utils, or different distributions of Linux. You can use the script below with small modifications in script starting the nfs daemon.
#!/bin/bash
#script for adding iptables rules to support exporting NFS share
#behind iptables firewall.
#get the port numbers
PORTS=`rpcinfo -p | awk '$4 != "port" { print $4 }' | uniq | paste -sd,`
#function to check/create iptables chain NFS
check_ipt () {
/sbin/iptables -L NFS >/dev/null 2>&1 || /sbin/iptables -N NFS
}
#function to insert iptables rules
ins_rul () {
/sbin/iptables -F NFS
/sbin/iptables -I NFS 1 -m state --state NEW -p tcp -m multiport --dports $PORTS,2049,111 -j ACCEPT
/sbin/iptables -I NFS 2 -m state --state NEW -p udp -m multiport --dports $PORTS,2049,111 -j ACCEPT
#change below as per your need/iptables chain name.
/sbin/iptables -R loc2fw 1 -j NFS
}
check_ipt
ins_rul
You can call this script from nfs startup script.
More options of securing NFS are available on TLDP site..
Anuj
