I'm trying to configure my firewall (PF) on FreeBSD to let NFS traffic through. I know that NFS uses both TCP and UDP to connect to the client along with a bunch of daemons that use random port numbers. Both the NFS server and client are Ubuntu 10.04. Instead of using port numbers for the filtering, I simply used the IP addresses of the client and server to allow the connection. The pf.conf rules pertaining to NFS are:

pass in log quick  from external to NFS
pass out log quick from NFS to external

As you can see, the external name is the client and NFS is the server. Both are resolved to their IP addresses. The problem is that some of the packets are being stopped by PF with the following error:

11:38:52.440123 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
NFS-lan0.sunrpc > External-lan1.38390:  tcp 40 [bad hdr length 0 - too short, < 20]

What do I need to change to let these packets through?
  • The last question "What do I need to change to let these packets through?" is part of the blockquote. Changing that will make this easier to read.
    – gabe.
    Dec 31, 2011 at 19:37

2 Answers 2


NFS is an old evil from the dark ages of Unix. ;-)

Your question relates to every firewall setup for NFS (v2 and v3 - not sure about v4). It uses RPC and the portmapper daemon.

The trick is to force the portmapper of the NFS-server to a specific port or port-range.

  • NFSv4 can (does?) use TCP on port 2049, but it can still fall back to older versions if a client doesn't support v4. Feb 9, 2012 at 18:06
  • With V4 starts the light - well it perhaps started with "secure NFS v3" - but that was a SUN specific extension using NIS+ credentials.
    – Nils
    Feb 9, 2012 at 21:15

PF is telling you why it's blocking the packets:

[bad hdr length 0 - too short, < 20]

Do you have scrub enabled in your pf.conf file?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .