Mailing List Archive: NFS using iptables PREROUTING?

Is it possible to access an NFS (v.3) server on a private network from a
machine on a public network?

I have a Debian Sid box B on a private network visible only to a gateway
G. B has drive partitions I would like to mount on outside box A.
To make B visible to A, I use this sort of thing for ssh:

iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9000 -j
DNAT --to 192.168.0.1:22

This allows me to ssh directly from A to B, as if B were on a public
network. Can I do the same with NFS? I use iptables 1.3.6.0debian1-5.

So far, I've figured out how to fix the port of mountd, statd, and
lockd, and I can preroute these ports, along with 2049 for nfs and 111
for portmap. For each of these, I can preroute tcp and udp packets on G:

# Forward tcp and udp on port 111 for portmap on A
iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9200 -j
DNAT --to 192.168.0.3:111
iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9200 -j
DNAT --to 192.168.0.3:111

# Forward tcp and upd for port 2049 for nfs to A (tcp may not be needed)
iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9201 -j
DNAT --to 192.168.0.3:2049
iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9201 -j
DNAT --to 192.168.0.3:2049

# Forward tcp and udp for lockd (port assigned in A:/boot/grub/menu.lst)
iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9202 -j
DNAT --to 192.168.0.3:4000
iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9202 -j
DNAT --to 192.168.0.3:4000

# Forward tcp and udp for mountd (port assigned in
A:/etc/default/nfs-common)
iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9203 -j
DNAT --to 192.168.0.3:4001
iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9203 -j
DNAT --to 192.168.0.3:4001

# Forward tcp and udp for statd (port assigned in A:/etc/default/nfs-common)
iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9204 -j
DNAT --to 192.168.0.3:4002
iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9204 -j
DNAT --to 192.168.0.3:4002
# Do you need a POSTROUTING line to take outgoing tcp/udp for statd on
port 4003?

Is there a way on the client A to specify where to look for the
different NFS resources on B (via G)?

How do I tell NFS that for this particular mount B, and only for B,
portmap is on 9200, nfs is on 9201, lockd on 9202, mountd on 9203, and
statd on 9204? Can I specify all of this in /etc/fstab? For ssh, I can
specify host:port in /etc/ssh/ssh_config, but it uses only one service.

On A, I also mount several other NFS drives, and they need the default
ports, so I can't forward the normal NFS ports on A indiscriminately to
the new ports needed by B through G. G, the gateway, also exports its
own drives to A via NFS, using the default ports, so I can't just remap
its ports either.

I would prefer straight NFS with iptables to ssh tunneling, but can it
be done? I'm extremly grateful for the functionality iptables provides
-- I use it to give SSH and Munin access to the private network, and the
private network access to the outside -- but I'm completely new to it
and found no examples of what I want to do with NFs.

Cheers,
Dave

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
NFS maillist - NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

David Liontooth wrote:
>
> Is it possible to access an NFS (v.3) server on a private network from a
> machine on a public network?
It turns out to be a lot simpler than I thought -- no need to worry
about lockd, portmap, or statd.

On the host A, set the mount port in /etc/default/nfs-kernel-server:

RPCMOUNTDOPTS="--port 4000"

In the gateway G's /etc/network/if-up.d/00-firewall, forward the NFS and
the mountd ports

# NFS: Forward udp on port 2049 to A on the private network
iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9101
-j DNAT --to 192.168.0.3:2049

# Forward tcp and udp for mountd on A (port assigned in
A:/etc/default/nfs-common)
iptables -t nat -A PREROUTING -p tcp -d 128.65.183.178 --dport 9201
-j DNAT --to 192.168.0.3:4000
iptables -t nat -A PREROUTING -p udp -d 128.65.183.178 --dport 9201
-j DNAT --to 192.168.0.3:4000

In the client B's /etc/hosts, define an alias for the NFS host behind
the firewall, using the IP address of the gateway:

128.65.183.178 a.fully.qualified.domain.name A

And in the client B's /etc/fstab, define the mount, adding the gateway's
ports that forward NFS and mount to the host:

A:/db1 /mnt/a1 nfs
noauto,user,exec,rw,rsize=16k,wsize=16k,hard,intr,port=9101,mountport=9201
0 0

Works beautifully and transparently. Or does someone spot a potential
problem?

Cheers,
Dave