Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 3 down vote favorite

I'm trying to configure my firewall (PF) on FreeBSD to let NFS traffic through. I know that NFS uses both TCP and UDP to connect to the client along with a bunch of daemons that use random port numbers. Both the NFS server and client are Ubuntu 10.04. Instead of using port numbers for the filtering, I simply used the IP addresses of the client and server to allow the connection. The pf.conf rules pertaining to NFS are:

pass in log quick  from external to NFS
pass out log quick from NFS to external

As you can see, the external name is the client and NFS is the server. Both are resolved to their IP addresses. The problem is that some of the packets are being stopped by PF with the following error:

11:38:52.440123 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
NFS-lan0.sunrpc > External-lan1.38390:  tcp 40 [bad hdr length 0 - too short, < 20]

What do I need to change to let these packets through?
share|improve this question
The last question "What do I need to change to let these packets through?" is part of the blockquote. Changing that will make this easier to read. – gabe. Dec 31 '11 at 19:37

2 Answers

up vote 1 down vote

NFS is an old evil from the dark ages of Unix. ;-)

Your question relates to every firewall setup for NFS (v2 and v3 - not sure about v4). It uses RPC and the portmapper daemon.

The trick is to force the portmapper of the NFS-server to a specific port or port-range.

share|improve this answer
NFSv4 can (does?) use TCP on port 2049, but it can still fall back to older versions if a client doesn't support v4. – James O'Gorman Feb 9 '12 at 18:06
With V4 starts the light - well it perhaps started with "secure NFS v3" - but that was a SUN specific extension using NIS+ credentials. – Nils Feb 9 '12 at 21:15
up vote 0 down vote

PF is telling you why it's blocking the packets:

[bad hdr length 0 - too short, < 20]

Do you have scrub enabled in your pf.conf file?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.