Shorewall
/etc/default/shorewall Set startup=1 In /usr/share/doc/shorewall-common/default-config make the following edits to the following files and then copy them to /etc/shorewall interfaces net eth1 82.94.91.79 modules (no edits) policy fw net ACCEPT net all DROP info all all REJECT info rules (under SECTION NEW) ACCEPT net fw tcp smtp ACCEPT net fw tcp pop3 ACCEPT net fw tcp ssh FTP/ACCEPT net fw ACCEPT net fw tcp domain ACCEPT net fw udp domain ACCEPT fw net udp domain ACCEPT net fw tcp http ACCEPT fw net tcp http ACCEPT net fw tcp https ACCEPT net fw tcp snmp ACCEPT fw net tcp snmp ACCEPT net fw udp snmp ACCEPT fw net udp snmp ACCEPT net fw tcp 143 ACCEPT net fw udp 143 start dmesg -n5 zones net ipv4 (above fw firewall)
To get NFS working
On the SERVER
Edit your /etc/shorewall/rules file like this:
# Permit NFS ACCEPT net $FW tcp 111 ACCEPT net $FW udp 111 ACCEPT net $FW udp 2049 ACCEPT net $FW tcp 2049 ACCEPT net $FW tcp 32765:32767 ACCEPT net $FW udp 32765:32767
/etc/default/nfs-common:
STATDOPTS="-p 32765 -o 32766"
/etc/default/nfs-kernel-server:
RPCMOUNTDOPTS="-p 32767"
The change to /etc/services isn't necessary at all. It just helps produces a nice (sensible) output from netstat -tl on the NFS server.
# /etc/services # NFS ports as per the NFS-HOWTO # http://www.tldp.org/HOWTO/NFS-HOWTO/security.html#FIREWALLS # Listing here does not mean they will bind to these ports. rpc.nfsd 2049/tcp # RPC nfsd rpc.nfsd 2049/udp # RPC nfsd rpc.statd-bc 32765/tcp # RPC statd broadcast rpc.statd-bc 32765/udp # RPC statd broadcast rpc.statd 32766/tcp # RPC statd listen rpc.statd 32766/udp # RPC statd listen rpc.mountd 32767/tcp # RPC mountd rpc.mountd 32767/udp # RPC mountd rcp.lockd 32768/tcp # RPC lockd/nlockmgr rcp.lockd 32768/udp # RPC lockd/nlockmgr rpc.quotad 32769/tcp # RPC quotad rpc.quotad 32769/udp # RPC quotad
/etc/default/quota
RPCRQUOTADOPTS="-p 32769"