Re: Configuring firewall with nfs - problem!

[Luca Berra <bluca () comedia it>]

On Mon, May 19, 2003 at 02:12:46PM +0200, Johan Glimming wrote:
> Dear All,
>
> I have a problem with my Redhat 9 installation. I am trying to enable NFS 
> but the respective ports are rejected. This is the contents of my 
> /etc/sysconfig/iptables, i.e. the firewall rules:

:(

let's see...
> # Enable NFS, Webb, FTP, SSH for sputnik 
> *filter
> :INPUT ACCEPT [0:0]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> :RH-Lokkit-0-50-INPUT - [0:0]
> -A INPUT -j RH-Lokkit-0-50-INPUT
this rule says in input chain JUMP to 'RH-Lokkit-0-50-INPUT'
> -A FORWARD -j RH-Lokkit-0-50-INPUT
>
> # NFS rules
> -A INPUT -f -j ACCEPT -s 192.168.0.5
<snip>
> # Other rules
->>>>>> it JUMPS HERE <<<<<<<-
<snip>
> -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --syn -j REJECT
rejects tcp packets
> -A RH-Lokkit-0-50-INPUT -p udp -m udp -j REJECT
rejects udp packets
> COMMIT
now if there is still something left to process (not tcp[start of
connection] or udp) it goes BACK to your NFS rule, but nfs has already
been dropped.

Please read the iptables howto at
http://netfilter.samba.org/documentation/HOWTO/
it is very much educative.

Also the firewall rules generated by lokkit on rh do suck, ditch 'em and
rewrite.

L.

--
Luca Berra -- bluca () comedia it
       Communication Media & Services S.r.l.
/"\
\ /     ASCII RIBBON CAMPAIGN
 X        AGAINST HTML MAIL
/ \
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards