We can see high NFS usage for a client that we want to kick off, but not affecting the other NFS clients. How can we do this? Only with using firewall?
You will need bos.net.ipsec.rte to be able to use an iptables like solution.
check your current installation with:
michael@x071:[/home/michael]lslpp -L bos.net.ipsec.rte Fileset Level State Type Description (Uninstaller) ---------------------------------------------------------------------------- bos.net.ipsec.rte 184.108.40.206 C F IP Security
If it is already installed, you can check if it is active, or inactive using:
michael@x071:[/home/michael]lsdev -C | grep ipsec ipsec_v4 Available IP Version 4 Security Extension ipsec_v6 Available IP Version 6 Security Extension
root@x064:[/]lsdev -C | grep ipsec
That is no output, meaning it has never been activated, or
root@x072:[/]lsdev -C | grep ipsec ipsec_v4 Defined IP Version 4 Security Extension ipsec_v6 Defined IP Version 6 Security Extension
some output meaning there maybe some configuration, but it has been deactivated.
Here are some examples of how you can switch on/off ipsec for v4 and-or v6 ipsec.
root@x072:[/]lsdev -C | grep ipsec ipsec_v4 Defined IP Version 4 Security Extension ipsec_v6 Available IP Version 6 Security Extension root@x072:[/]mkdev -l ipsec_v4 ipsec_v4 Available root@x072:[/]rmdev -l ipsec_v6 ipsec_v6 Defined root@x072:[/]lsdev -C | grep ipsec ipsec_v4 Available IP Version 4 Security Extension ipsec_v6 Defined IP Version 6 Security Extension
Now to stopping nfs per client (defined as an IP address)
Let's take the IP address 192.168.111.222 as the address of the client I want to stop. There are different actions that can be taken - permit and deny are the common ones - we can be a bit fancy though and use block-port that creates a new dynamic deny rule each time a port tries to connect - this way you can see how active the unique mount requests are:
We need to focus on port 2049
root@x072:[/]grep nfs /etc/services nfsd-status 1110/tcp # Cluster status info nfsd-keepalive 1110/udp # Client status info picknfs 1598/tcp # picknfs picknfs 1598/udp # picknfs shiva_confsrvr 1651/tcp # shiva_confsrvr shiva_confsrvr 1651/udp # shiva_confsrvr #nfs 2049/tcp # Network File System - Sun Microsystems #nfs 2049/udp # Network File System - Sun Microsystems 3d-nfsd 2323/tcp # 3d-nfsd 3d-nfsd 2323/udp # 3d-nfsd mediacntrlnfsd 2363/tcp # Media Central NFSD mediacntrlnfsd 2363/udp # Media Central NFSD
Note: to use smit(ty) use:
and then use Advanced...->Add
Add an IP Security Filter Rule Type or select values in entry fields. Press Enter AFTER making all desired changes. [Entry Fields] * Rule Action [shun_port] + * IP Source Address [192.168.111.222] * IP Source Mask [255.255.255.255] IP Destination Address [0.0.0.0] IP Destination Mask [0.0.0.0] * Apply to Source Routing? (PERMIT/inbound only) [yes] + * Protocol [tcp] + * Source Port / ICMP Type Operation [any] + * Source Port Number / ICMP Type  # * Destination Port / ICMP Code Operation [eq] + * Destination Port Number / ICMP Type  # * Routing [local] + * Direction [inbound] + * Log Control [no] + * Fragmentation Control  + * Interface [all] + Expiration Time (sec)  # Pattern Type [none] + Pattern / Pattern File  Description <g port on NFS request]
Or from the command line:
/usr/sbin/genfilt -v 4 -a 'S' -s '192.168.111.222' -m '255.255.255.255' -d '0.0.0.0' -M '0.0.0.0' -g 'y' -c 'tcp' -o 'any' -p '0' -O 'eq' -P '2049' -r 'L' -w 'I' -l 'N' -t '0' -i 'all' -e '300' -D 'block incoming port on NFS request'
And either in smit, or from the command line - activate the rule
mkfilt -v4 -u
and to see the configured rules
lsfilt -v4 -O
and to see any (maybe) dynamic rules
lsfilt -v4 -a -O
** Comment I cannot yet add: in case you need a change right NOW - as this only affects future connections to the port you can use the commands:
nfs.clean; sleep 2; rc.nfs
to stop, then restart nfs services. Note that
stopsrc -g nfs; startsrc -g nfs
does not start the daemons in the proper sequence
tcpkill to send reset packets to both sides.
tcpkill uses same params as tcpdump