From owner-freebsd-questions Fri Oct 11 13: 9:50 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E1B6737B401 for ; Fri, 11 Oct 2002 13:09:48 -0700 (PDT) Received: from akira.lanfear.com (akira.lanfear.com [216.168.61.84]) by mx1.FreeBSD.org (Postfix) with SMTP id 7904C43E88 for ; Fri, 11 Oct 2002 13:09:48 -0700 (PDT) (envelope-from mw@lanfear.com) Received: (qmail 67518 invoked from network); 11 Oct 2002 20:09:48 -0000 Received: from akira.lanfear.com (HELO there) (216.168.61.84) by akira.lanfear.com with SMTP; 11 Oct 2002 20:09:48 -0000 Content-Type: text/plain; charset="iso-8859-1" From: Mark Reply-To: mw@lanfear.com To: questions@freebsd.org Subject: NFS rules for ipfw Date: Fri, 11 Oct 2002 13:09:42 -0700 X-Mailer: KMail [version 1.3.1] MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-Id: <20021011200948.7904C43E88@mx1.FreeBSD.org> Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Hello! I've got a little server here that is acting as a nat/router and firewall to connect our home to the internet. i would, in addition, like to run NFS on this machine so that computers on the internal network can share disks from it . (Yes, I realize this is sub-optimal and an NFS server should theoretically be a separate machine, but there are cost and space issues here ...) The problem is, I have a "simple" firewall up and running on this machine that prevents the internal machines from connecting to the server via NFS. (I've already verified changing the firewall to "open" allows NFS client access). My Question is: Is there a set of rules I can add to the server to allow NFS clients from the LOCAL network only, but still prevent NFS requests from the outside net? I've tried things like: ${fwcmd} add pass udp from ${inet}:${imask} to ${iip} 2049 ${fwcmd} add pass tcp from ${inet}:${imask} to ${iip} 2049 and similar rules for port 369 (RPC2) and 111 (Sun RPC), but without any luck -- client machines always give RPC Timed Out messages on mounts or any other request. Any suggestions? Thanks, Mark. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message