NFS servers and firewalld

Question

I haven't found a slam-dunk document on this, so let's start one.

On a CentOS 7.1 host, I have gone through the linuxconfig HOW-TO, including the firewall-cmd entries, and I have an exportable filesystem.

[root@<server> ~]# firewall-cmd --list-all
internal (default, active)
  interfaces: enp5s0
  sources: 192.168.10.0/24
  services: dhcpv6-client ipp-client mdns ssh
  ports: 2049/tcp
  masquerade: no
  forward-ports: 
  rich rules: 

[root@<server> ~]# showmount -e localhost
Export list for localhost:
/export/home/<user> *.localdomain

However, if I showmount from the client, I still have a problem.

[root@<client> ~]# showmount -e <server>.localdomain
clnt_create: RPC: Port mapper failure - Unable to receive: errno 113 (No route to host)

Now, how am I sure that this is a firewall problem? Easy. Turn off the firewall. Server side:

[root@<server> ~]# systemctl stop firewalld

And client side:

[root@<client> ~]# showmount -e <server>.localdomain
Export list for <server>.localdomain:
/export/home/<server> *.localdomain

Restart firewalld. Server side:

[root@<server> ~]# systemctl start firewalld

And client side:

[root@<client> ~]# showmount -e <server>.localdomain
clnt_create: RPC: Port mapper failure - Unable to receive: errno 113 (No route to host)

So, let's go to town, by adapting the iptables commands from a RHEL 6 NFS server HOW-TO...

[root@ ~]# firewall-cmd \
>  --add-port=111/tcp \
>  --add-port=111/udp \
>  --add-port=892/tcp \
>  --add-port=892/udp \
>  --add-port=875/tcp \
>  --add-port=875/udp \
>  --add-port=662/tcp \
>  --add-port=662/udp \
>  --add-port=32769/udp \
>  --add-port=32803/tcp
success

[root@<server> ~]# firewall-cmd \
>  --add-port=111/tcp \
>  --add-port=111/udp \
>  --add-port=892/tcp \
>  --add-port=892/udp \
>  --add-port=875/tcp \
>  --add-port=875/udp \
>  --add-port=662/tcp \
>  --add-port=662/udp \
>  --add-port=32769/udp \
>  --add-port=32803/tcp \
>  --permanent
success

[root@<server> ~]# firewall-cmd --list-all
internal (default, active)
  interfaces: enp5s0
  sources: 192.168.0.0/24
  services: dhcpv6-client ipp-client mdns ssh
  ports: 32803/tcp 662/udp 662/tcp 111/udp 875/udp 32769/udp 875/tcp 892/udp 2049/tcp 892/tcp 111/tcp
  masquerade: no
  forward-ports: 
  rich rules: 

This time, I get a slightly different error message from the client:

[root@<client> ~]# showmount -e <server>.localdomain
rpc mount export: RPC: Unable to receive; errno = No route to host

So, I know I'm on the right track. Having said that, why can't I find a definitive tutorial on this anywhere? I can't have been the first person to have to figure this out!

What firewall-cmd entries am I missing?

Oh, one other note. My /etc/sysconfig/nfs files on the CentOS 6 client and the CentOS 7 server are unmodified, so far. I would prefer to not have to change (and maintain!) them, if at all possible.

Answer 1

This should be enough:

firewall-cmd --permanent --add-service=nfs
firewall-cmd --permanent --add-service=mountd
firewall-cmd --permanent --add-service=rpc-bind
firewall-cmd --reload

Answer 2

After configuring NFS server we should enable and start three services:

1. nfs-server.service
2. rpcbind.service
3. nfs-mountd.service (only start is needed)

And also allow these services on server firewall:

# firewall-cmd --permanent --add-service=nfs
# firewall-cmd --permanent --add-service=rpcbind
# firewall-cmd --permanent --add-service=mountd
# firewall-cmd --reload

Answer 3

Just found this - and it works when the problem is SELinux blocking the reading of the ~/.ssh/authorized_keys during login! First, enxure your ~/.ssh/authorized_keys file is properly populated and its permissions and its folder's permissions are set correctly. If you then run "setenforce 0" on the SSH destination host and are able to login to that host without entering a password, but cannot do so after entering "setenforce 1" on that same destination host, the following may fix your issue:

setsebool -P use_nfs_home_dirs 1

ref: https://cassjohnston.wordpress.com/2015/06/12/selinux-nfs-home-directories/

Answer 4

I use nfsv4 and works fine with those lines, supposing your zone is "public" and you are using the default ports 2049 and 4001

firewall-cmd --permanent --add-service=nfs --zone=public
firewall-cmd --permanent --add-service=mountd --zone=public
firewall-cmd --permanent --add-service=rpc-bind --zone=public
firewall-cmd --permanent --add-port=4001/udp --zone=public
firewall-cmd --permanent --add-port=4001/tcp --zone=public
firewall-cmd --permanent --add-port=2049/tcp --zone=public
firewall-cmd --permanent --add-port=2049/udp --zone=public
firewall-cmd --reload

I forgot one important thing: is useful to set a static port for mountd, so you can use showmount -e to see the shares. Personally I use 34777

root      1873     1  0 21:11 ?        00:00:00 /usr/sbin/rpc.mountd -p 34777

So you will open port on firewall

  firewall-cmd --permanent --add-port=34777/udp --zone=public
  firewall-cmd --permanent --add-port=34777/tcp --zone=public

The configuration of mount port is different from distro, some uses /etc/sysconfig some other use /etc/default, some other require to edit scripts..check the docs for your distro.