NFS using iptables PREROUTING?

DISCUSSION David Liontooth 2 participants 4 messages Jul 8, 2007 – Jul 9, 2007

Subsystems (2)

NFS client NFS server

lore

Share & tools

lore

David Liontooth

author

2007-07-08 16:18 UTC #0 lore raw

Is it possible to access an NFS server on a private network from a machine on a public network?

I have a Debian box B on a private network visible only to a gateway G. B has drive partitions I would like to mount on outside box A. To make B visible to A, I use this sort of thing for ssh:

iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9000 -j
DNAT --to 192.168.0.1:22

This allows me to ssh directly from A to B, as if B were on a public network. Can I do the same with NFS?

So far, I've figured out how to fix the port of mountd, statd, and lockd, and I can preroute these ports, along with 2049 for nfs and 111 for portmap.
For each of these, I can preroute tcp and udp packets on G:

# Forward tcp and udp on port 111 for portmap on A
iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9200 -j
DNAT --to 192.168.0.3:111
iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9200 -j
DNAT --to 192.168.0.3:111

# Forward tcp and upd for port 2049 for nfs to A (tcp may not be needed)
iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9201 -j
DNAT --to 192.168.0.3:2049
iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9201 -j
DNAT --to 192.168.0.3:2049

# Forward tcp and udp for lockd (port assigned in A:/boot/grub/menu.lst)
iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9202 -j
DNAT --to 192.168.0.3:4000
iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9202 -j
DNAT --to 192.168.0.3:4000

# Forward tcp and udp for mountd (port assigned in A:/etc/default/nfs-common)
iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9203 -j
DNAT --to 192.168.0.3:4001
iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9203 -j
DNAT --to 192.168.0.3:4001

# Forward tcp and udp for statd (port assigned in A:/etc/default/nfs-common)
iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9204 -j
DNAT --to 192.168.0.3:4002
iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9204 -j
DNAT --to 192.168.0.3:4002
# Do you need a POSTROUTING line to take outgoing tcp/udp for statd on port 4003?

However, at this point I get a sinking feeling this is still not possible.

Is there a way on the client A to specify where to look for the different NFS resources on B (via G)?

How do I tell NFS that for this particular mount B, and only for B, portmap is on 9200, nfs is on 9201, lockd on 9202, mountd on 9203, and statd on 9204?
Can I specify all of this in /etc/fstab? For ssh, I can specify host:port in /etc/ssh/ssh_config, but it uses only one service.

On A, I also mount several other NFS drives, and they need the default ports.
G, the gateway, also exports its own drives to A via NFS, using the default ports.

I would prefer straight NFS with iptables to ssh tunneling, but can it be done?

Cheers,
Dave

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

David Liontooth

author

2007-07-09 06:25 UTC #1 lore raw

Quoted 3 lines · David Liontooth

Is it possible to access an NFS server on a private network from a machine on a public network?

It turns out to be a lot simpler than I thought -- no need to worry about lockd, portmap, or statd.

On the host A, set the mountd port in /etc/default/nfs-kernel-server:

    RPCMOUNTDOPTS="--port 4000"

In the gateway G's /etc/network/if-up.d/00-firewall, forward the NFS and the mountd ports

# NFS: Forward udp on port 2049 to A on the private network iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9101
-j DNAT --to 192.168.0.3:2049

# Forward tcp and udp for mountd on A (port assigned in
A:/etc/default/nfs-common)

    iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9201 
-j DNAT --to 192.168.0.3:4000
    iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9201

-j DNAT --to 192.168.0.3:4000

In the client B's /etc/hosts, define an alias for the NFS host behind the firewall, using the IP address of the gateway:

128.65.183.178 a.fully.qualified.domain.name A

And in the client B's /etc/fstab, define the mount, adding the gateway's ports that forward NFS and mountd to the host:

A:/db1 /mnt/a1 nfs
noauto,user,exec,rw,rsize=16k,wsize=16k,hard,intr,port=9101,mountport=9201 0 0

Works beautifully and transparently. Or does someone spot a potential problem?

Cheers,
Dave

Jeff Layton

2007-07-09 10:39 UTC #2 lore raw

Quoted 33 lines · On Sun, 08 Jul 2007 23:25:00 -0700 David Liontooth <[email protected]> wrote:

Quoted 3 lines · David Liontooth
Is it possible to access an NFS server on a private network from a machine on a public network?
It turns out to be a lot simpler than I thought -- no need to worry about lockd, portmap, or statd.
On the host A, set the mountd port in /etc/default/nfs-kernel-server:
    RPCMOUNTDOPTS="--port 4000"
In the gateway G's /etc/network/if-up.d/00-firewall, forward the NFS and the mountd ports
# NFS: Forward udp on port 2049 to A on the private network iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9101
-j DNAT --to 192.168.0.3:2049
# Forward tcp and udp for mountd on A (port assigned in
A:/etc/default/nfs-common)
    iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9201 
(quoted diff) +0 -2
-j DNAT --to 192.168.0.3:4000
    iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9201 
-j DNAT --to 192.168.0.3:4000
In the client B's /etc/hosts, define an alias for the NFS host behind the firewall, using the IP address of the gateway:
   128.65.183.178  a.fully.qualified.domain.name   A
And in the client B's /etc/fstab, define the mount, adding the gateway's ports that forward NFS and mountd to the host:

Quoted 7 lines

   A:/db1 /mnt/a1 nfs 
noauto,user,exec,rw,rsize=16k,wsize=16k,hard,intr,port=9101,mountport=9201 0 0
Works beautifully and transparently. Or does someone spot a potential problem?

That should work fine, unless you have applications that do posix locking. In that case, you'll likely have problems since lockd can't be reached. An even easier method might be to consider moving to NFSv4, which just uses port 2049 for everything.

Signature · 10 lines

Jeff Layton <[email protected]>

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
NFS maillist  -  [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

David Liontooth

author

2007-07-09 18:38 UTC #3 lore raw

Quoted 43 lines · Jeff Layton

Quoted 39 lines · On Sun, 08 Jul 2007 23:25:00 -0700 David Liontooth <[email protected]> wrote:
Quoted 4 lines · David Liontooth
Is it possible to access an NFS server on a private network from a machine on a public network?
It turns out to be a lot simpler than I thought -- no need to worry about lockd, portmap, or statd.
On the host A, set the mountd port in /etc/default/nfs-kernel-server:
    RPCMOUNTDOPTS="--port 4000"
In the gateway G's /etc/network/if-up.d/00-firewall, forward the NFS and the mountd ports
# NFS: Forward udp on port 2049 to A on the private network iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9101
-j DNAT --to 192.168.0.3:2049
# Forward tcp and udp for mountd on A (port assigned in
A:/etc/default/nfs-common)
    iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9201 
(quoted diff) +0 -2
-j DNAT --to 192.168.0.3:4000
    iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9201 
-j DNAT --to 192.168.0.3:4000
In the client B's /etc/hosts, define an alias for the NFS host behind the firewall, using the IP address of the gateway:
   128.65.183.178  a.fully.qualified.domain.name   A
And in the client B's /etc/fstab, define the mount, adding the gateway's ports that forward NFS and mountd to the host:
   A:/db1 /mnt/a1 nfs 
noauto,user,exec,rw,rsize=16k,wsize=16k,hard,intr,port=9101,mountport=9201 0 0

Quoted 11 lines

Quoted 4 lines
Works beautifully and transparently. Or does someone spot a potential problem?
That should work fine, unless you have applications that do posix locking. In that case, you'll likely have problems since lockd can't be reached. An even easier method might be to consider moving to NFSv4, which just uses port 2049 for everything.

Very useful, thank you.