 | | | firewall settings | firewall settings 2007-01-25 - By chuck lawrence
Back
Rick Stevens <rstevens@(protected)> sez...
>> at installation, I asked for the firewall setting of ssh-only, or so I
>> believe. I was surprised, then, to find nfs working (I have a potential
>> nfs client behind a firewall, and I'm trying to create a test box to
>> troubleshoot before asking for holes in *that* firewall).
>
> How do you know NFS was working? The fact that the nfsd daemon is
> running doesn't mean NFS is functional. Connections need to go through
> the firewall.
well, I was able to mount the volume from my server. I wanted to see it
fail before I tried to fix it - only it didn't fail. I could see the
directories and everything.
> Not necessarily. Again, having portmap and nfsd doesn't mean people
> can get to your server. If the firewall blocks access to portmap and
> the daemon, people can't mount your NFS shares.
maybe I wasn't clear before. the host with the alleged firewall is an
nfs client (as is the problem host). no firewall on the server, but my
production host can't mount the volume, and my test host can.
to summarize and clarify(?): with my firewall set to ssh-only, the nfs
client works.
>> also, with my local firewall running(?), web access works, but is
>> excruciatingly slow - like 45 seconds to open a page.
>
> That's probably because you have DNS blocked as well. Make sure you
> leave port UDP port 53 open (it might be good to leave TCP port 53 open
> as well).
makes sense. thanks.
> I'd recommend running nmap or nmapfe against your machine's IP and see
> what ports really are open. Make sure you use the real IP and not
> localhost (127.0.0.1).
also good. thanks for educating me.
--
* -- ---- ---- ------ * -- ---- ---- ---- ---- -----*
| charles e. lawrence | lawrence berkeley nat'l lab |
| celawrence@(protected) | #1 cyclotron rd ms 50a6134 |
| (510) 486-4682 | berkeley ca 94720 |
* -- ---- ---- ------ * -- ---- ---- ---- ---- -----*
www-eng.lbl.gov/~celawrence
__ ____ ____ ____ ____ ____ ____ ____ ____ ____
Redhat-install-list mailing list
Redhat-install-list@(protected)
https://www.redhat.com/mailman/listinfo/redhat-install-list
To Unsubscribe Go To ABOVE URL or send a message to:
redhat-install-list-request@(protected)
Subject: unsubscribe
|
|
|