NFSv4 guest opens random ports
Subsystems (2)
I have systems running Gentoo Linux mounting shares hosted on a Gentoo Linux server. All are running 3.12.8 kernels and using NFS 4.
I've followed all instructions I can find for fixing everything to a static port, but I still see one instance ofrandom port behavior.
A kernel process (does not display a PID in netstat) on the guests is opening listening sockets on random high-numbered ports. The server is attempting to contact those guests via random low-numbered ports, which my firewall is blocking.
Despite these packets being blocked, I haven't noticed any adverse effects - everything appears to work normally except for my system logs on the server being spammed with blocked outgoing connection attempts.
What is this random port the client is trying to accept connections on, and how do I make it listen on a fixed port instead of a random one so that I can write useful firewall rules?
Quoted 11 lines · Justus Ranvier
I have systems running Gentoo Linux mounting shares hosted on a Gentoo Linux server. All are running 3.12.8 kernels and using NFS 4.
I've followed all instructions I can find for fixing everything to a static port, but I still see one instance ofrandom port behavior.
A kernel process (does not display a PID in netstat) on the guests is opening listening sockets on random high-numbered ports. The server is attempting to contact those guests via random low-numbered ports, which my firewall is blocking.
Quoted 8 lines
Despite these packets being blocked, I haven't noticed any adverse effects - everything appears to work normally except for my system logs on the server being spammed with blocked outgoing connection attempts.
What is this random port the client is trying to accept connections on, and how do I make it listen on a fixed port instead of a random one so that I can write useful firewall rules?
That’s probably the NFSv4 callback port. Please see your kernel Documentation/kernel-parameters.txt for how to set the nfs.callback_tcpport kernel/module option.
--
Trond Myklebust
Linux NFS client maintainer
Quoted 17 lines · Trond Myklebust
Quoted 15 lines · Justus Ranvier
I have systems running Gentoo Linux mounting shares hosted on a Gentoo Linux server. All are running 3.12.8 kernels and using NFS 4.
I've followed all instructions I can find for fixing everything to a static port, but I still see one instance ofrandom port behavior.
A kernel process (does not display a PID in netstat) on the guests is opening listening sockets on random high-numbered ports. The server is attempting to contact those guests via random low-numbered ports, which my firewall is blocking.
Despite these packets being blocked, I haven't noticed any adverse effects - everything appears to work normally except for my system logs on the server being spammed with blocked outgoing connection attempts.
Quoted 5 lines
Quoted 4 lines
What is this random port the client is trying to accept connections on, and how do I make it listen on a fixed port instead of a random one so that I can write useful firewall rules?
That’s probably the NFSv4 callback port. Please see your kernel
Documentation/kernel-parameters.txtfor how to set the nfs.callback_tcpport kernel/module option.
Thanks you, that was indeed the problem. I was able to set this port via the kernel command line and resolve my firewalling difficulties.
I thought I'd be able to set that parameter via sysctl.conf, in the same manner as sys.fs.nfs.nlm_tcpport and sys.fs.nfs.nlm_udpport, but that method returns an error.
Would it be possible to make this port configurable in the same manner as lock manager ports via sysctl, or as an explicit compile time option?