# Shorewall Firewall and NFS static port issues [ SOLVED ]

## flipnode

I have shorewall setup and running great. I've found many documents explaining that shorewall has issues with NFS and the random ports its assigned. I have setup static ports for NFS and have added TCP and UDP rules for NFS ports in /etc/shorewall/rules. After restarting NFS and shorewall on the server, I try and mount to NFS and it just hangs. I'm sure I have everything setup correctly. I'm at a lose , as to why this isn't working. Maybe it has to do with my current kernel. All files and specs are below.

# /etc/shorewall/rules

```

ACCEPT  loc   fw              tcp     22,80

ACCEPT  loc   fw              tcp     nfs,4000,4001,4002

ACCEPT  loc   fw              udp     nfs,4000,4001,4002

ACCEPT net    fw              tcp     22,80

```

# /etc/shorewall/policy

```

fw              net             ACCEPT

loc             fw              ACCEPT

net             all             DROP            info

all             all             REJECT          info

```

# /etc/conf.d/nfs

```

# If you wish to set the port numbers for lockd,

# please see /etc/sysctl.conf

# Number of servers to be started up by default

RPCNFSDCOUNT=6

# Options to pass to rpc.mountd

# ex. RPCMOUNTDOPTS="-p 32767

RPCMOUNTDOPTS="-p 4000"

# Options to pass to rpc.statd

# ex. RPCSTATDOPTS="-p 32765 -o 32766"

RPCSTATDOPTS="-p 4002"

# Options to pass to rpc.idmapd

RPCIDMAPDOPTS="4003"

# Timeout (in seconds) for exportfs

EXPORTFSTIMEOUT=15

```

# /etc/sysctl.conf

```

# TCP Port for lock manager

fs.nfs.nlm_tcpport = 4001

# UDP Port for lock manager

fs.nfs.nlm_udpport = 4001

```

#rpcinfo -p

```

   program vers proto   port

    100000    2   tcp    111  portmapper

    100000    2   udp    111  portmapper

    100024    1   udp   4002  status

    100024    1   tcp   4002  status

    100003    2   udp   2049  nfs

    100003    3   udp   2049  nfs

    100003    4   udp   2049  nfs

    100003    2   tcp   2049  nfs

    100003    3   tcp   2049  nfs

    100003    4   tcp   2049  nfs

    100021    1   udp   4001  nlockmgr

    100021    3   udp   4001  nlockmgr

    100021    4   udp   4001  nlockmgr

    100021    1   tcp   4001  nlockmgr

    100021    3   tcp   4001  nlockmgr

    100021    4   tcp   4001  nlockmgr

    100005    1   udp   4000  mountd

    100005    1   tcp   4000  mountd

    100005    2   udp   4000  mountd

    100005    2   tcp   4000  mountd

    100005    3   udp   4000  mountd

    100005    3   tcp   4000  mountd

```

My system information

```

System uname: 2.6.11-gentoo-r6 i586 Pentium MMX

Gentoo Base System version 1.6.12

Python:              dev-lang/python-2.3.5 [2.3.5 (#1, May 23 2005, 02:20:21)]

distcc 2.18.3 i586-pc-linux-gnu (protocols 1 and 2) (default port 3632) [disabled]

ccache version 2.3 [enabled]

dev-lang/python:     2.3.5

sys-apps/sandbox:    [Not Present]

sys-devel/autoconf:  2.59-r6, 2.13

sys-devel/automake:  1.7.9-r1, 1.8.5-r3, 1.5, 1.4_p6, 1.6.3, 1.9.5

sys-devel/binutils:  2.15.92.0.2-r7

sys-devel/libtool:   1.5.18-r1

virtual/os-headers:  2.6.11-r2

ACCEPT_KEYWORDS="x86"

AUTOCLEAN="yes"

```

If I start and stop NFS the ports are the same each time.

I was thinking it was when portmapper created the random ports it created different ports for TCP and UDP. Could this be the issue? My guess is no. As you can see everything seems to be setup correctly. What is the deal?

----------

## steveb

You have a policy "loc             fw              ACCEPT " and therefore you don't need to allow anything in the rules for "loc             fw" anymore.

Allow me to ask you, how many nic's you have in the server?

Just one?

Or is this a dual or tripple nic setup?

If it is a dual setup (one nic is for internal and the other for external), then you could solve this problem more elegant. Just let me know.

cheers

SteveB

----------

## flipnode

I only have 1 nic

I keep getting this error when starting shorewall, maybe it is causing the issue.

```

flipnode@core ~ $ sudo /etc/init.d/shorewall restart

 * Restarting firewall ...

   Warning: Zone loc is empty      

```

----------

## flipnode

I've commented out 'loc fw' rules, and restarted and that didn't solve anything.

----------

## flipnode

To the hell with NFS, I'm going to use SHFS. At least I will be dealing with a secure system now!

----------

## flipnode

I have setup SHFS and it works great. I wouldn't recommend streaming mp3's accross it.

----------

