What ports need to be open for netatalk to work as a Time Machine server on my LAN?

Question

I've got netatalk running as an AFP server so I can make Time Machine backups on my LAN. It works perfectly as long as iptables accepts all incoming traffic on the LAN, but I'm trying to tighten up security on the server, so I set the default iptables input policy to REJECT, and now I need to open up the ports needed for Time Machine. I'm using [ferm][1] to configure iptables.

I added the following rule in ferm.conf:

proto tcp saddr $LAN_SUBNET dport afpovertcp ACCEPT;

which generates this iptable rule:

-A INPUT --protocol tcp --source 192.168.42.0/24 --dport afpovertcp --jump ACCEPT

but the Time Machine server still isn't showing up when I browse Network in Finder.

What other ports need to be open to traffic on the LAN?

Answer 1

I opened these ports, and Time Machine backups are now working:

afpovertcp mdns svrloc at-rtmp at-nbp at-echo at-zis 1900

To generate the iptables rules I added the following to ferm.conf:

# netatalk daemon ports for AFP Time Machine server
@def $PORT_TIME_MACHINE = (afpovertcp mdns svrloc at-rtmp at-nbp at-echo at-zis 1900);

# allow AFP connentions on for Time Machine on LAN
proto (udp tcp) saddr $LAN_SUBNET dport $PORT_TIME_MACHINE ACCEPT;

New iptables rules:

-A INPUT --protocol udp --source 192.168.42.0/24 --dport afpovertcp --jump ACCEPT
-A INPUT --protocol udp --source 192.168.42.0/24 --dport mdns --jump ACCEPT
-A INPUT --protocol udp --source 192.168.42.0/24 --dport svrloc --jump ACCEPT
-A INPUT --protocol udp --source 192.168.42.0/24 --dport at-rtmp --jump ACCEPT
-A INPUT --protocol udp --source 192.168.42.0/24 --dport at-nbp --jump ACCEPT
-A INPUT --protocol udp --source 192.168.42.0/24 --dport at-echo --jump ACCEPT
-A INPUT --protocol udp --source 192.168.42.0/24 --dport at-zis --jump ACCEPT
-A INPUT --protocol udp --source 192.168.42.0/24 --dport 1900 --jump ACCEPT
-A INPUT --protocol tcp --source 192.168.42.0/24 --dport afpovertcp --jump ACCEPT
-A INPUT --protocol tcp --source 192.168.42.0/24 --dport mdns --jump ACCEPT
-A INPUT --protocol tcp --source 192.168.42.0/24 --dport svrloc --jump ACCEPT
-A INPUT --protocol tcp --source 192.168.42.0/24 --dport at-rtmp --jump ACCEPT
-A INPUT --protocol tcp --source 192.168.42.0/24 --dport at-nbp --jump ACCEPT
-A INPUT --protocol tcp --source 192.168.42.0/24 --dport at-echo --jump ACCEPT
-A INPUT --protocol tcp --source 192.168.42.0/24 --dport at-zis --jump ACCEPT
-A INPUT --protocol tcp --source 192.168.42.0/24 --dport 1900 --jump ACCEPT

These resources were helpful: Netatalk article on Arch wiki; TCP and UDP ports used by Apple software products