Re: firewall settings

[chuck lawrence <celawrence lbl gov>]

Rick Stevens <rstevens vitalstream com> sez...

> > at installation, I asked for the firewall setting of ssh-only, or so I 
> > believe.  I was surprised, then, to find nfs working (I have a potential 
> > nfs client behind a firewall, and I'm trying to create a test box to 
> > troubleshoot before asking for holes in *that* firewall).
>
> How do you know NFS was working?  The fact that the nfsd daemon is
> running doesn't mean NFS is functional.  Connections need to go through
> the firewall.

well, I was able to mount the volume from my server.  I wanted to see it 
fail before I tried to fix it - only it didn't fail.  I could see the 
directories and everything.

> Not necessarily.  Again, having portmap and nfsd doesn't mean people
> can get to your server.  If the firewall blocks access to portmap and
> the daemon, people can't mount your NFS shares.

maybe I wasn't clear before.  the host with the alleged firewall is an 
nfs client (as is the problem host).  no firewall on the server, but my 
production host can't mount the volume, and my test host can.

to summarize and clarify(?):  with my firewall set to ssh-only, the nfs 
client works.

> > also, with my local firewall running(?), web access works, but is 
> > excruciatingly slow - like 45 seconds to open a page.
>
> That's probably because you have DNS blocked as well.  Make sure you
> leave port UDP port 53 open (it might be good to leave TCP port 53 open
> as well).

makes sense.  thanks.

> I'd recommend running nmap or nmapfe against your machine's IP and see
> what ports really are open.  Make sure you use the real IP and not
> localhost (127.0.0.1).

also good.  thanks for educating me.


--

 * ------------------- * ----------------------------*
 | charles e. lawrence | lawrence berkeley nat'l lab |
 | celawrence lbl gov  | #1 cyclotron rd  ms 50a6134 |
 | (510) 486-4682      | berkeley  ca  94720         |
 * ------------------- * ----------------------------*

             www-eng.lbl.gov/~celawrence