How to open firewalld ports correctly?

General system Newbie
21

Unfortunately my NAS is down, so I can’t check. But it looks like your mountd uses 20048/tcp and 20048/udp, so add these to the firewalld rule set on the server.

22

That is the server output. Please check on your NAS, if you find the time, i am thankful for every help.

23

As it should be :wink: But these must be open on the server’s firewalld, so a client can mount the export.

24

I also checked rpcinfo -p from my client to the server and i am getting the same list, but still shwomount -e gives back the error from above.

25

Did you set up an extra rule set, activated it (checkbox), does it include 111, and did you activate it in the zone you use and in the “Permanent” section, then restarted firewalld?

(Can all be done from the “Firewall” GUI)

26

Yes, i tried it several times. :sob:

27

Did you try switching to nfsv4?

28

Might need specific selection on client, we have (usually enabled):

# vers4=y
# vers4.0=y
# vers4.1=y
# vers4.2=y

…and all are slightly different (sigh).

29

This is what i did:

To provide both NFSv3 and NFSv4 service, start and enable nfs-server.service.

But i will disable it tomorrow and just try:

To provide NFSv4 service exclusively, start and enable nfsv4-server.service.

I am very thankful for all your inputs.

30

Usually, enabling nfs-server.service should enable what’s specified (or defaulted) in /etc/nfs.conf, which would be NFSv3 + all the NFSv4 versions shown above. (The server can actually handle both v3 & v4 if so desired.)

A fresh /etc/nfs.conf usually shows all the defaults as commented-out entries.

31

I also tried the nfsv4-server.service, no change. If i set the firewalld to trusted and check with rpcinfo -p from my client to the server, i get the same list as i did with the home zone. So my resume as always, i am missing some sort of setting in firewalld and it blocks the connection somehow.

32

Please post your /etc/exports.

33

/home/saeniv/Pictures/ *(rw,sync,insecure,no_subtree_check,crossmnt,fsid=0)

34

Looks good to me.

35

Looks sane to me, except

  • I’d skip the trailing slash / on …/Pictures/

If not all GIDs/UIDs are the same on your machines, I’d also think about an all_squash and setting uid and gid to your “saeniv” user (adding something like all_squash,anonuid=1000,anongid=1000).

This would map any access from any UID/GID to the anonymous user, which in this case is set up as UID=1000, GID=1000 (hopefully your “saeniv” user’s values; check with id).

36

Hello,

In the NFS section in the arch wiki, there is this line, which I missed:

To enable access of NFSv3 servers, you will additionally need to open TCP/UDP port 111 for the portmapper (rpcbind), as well as the MOUNT (rpc.mountd) port. By default, rpc.mountd selects a port dynamically, so if you’re behind a firewall you will want to edit /etc/nfs.conf to set a static port instead. Use rpcinfo -p to examine the exact ports in use on the NFSv3 server:

If you check rpcinfo -p on your host, you will see a port for “mountd”, which you also have to open, for me it was 20048.

If you just use the nfsv4, you could just use the port 2049, but don’t try “showmount -e” on the client. This is the command to mount nfsv4 folder:

mount servername:/ /mountpoint/on/client

I tried to create the nfs server and wanted to check anything before I mounted the folder and this was my mistake, I should have tried nfsv4 at the beginning, I am sorry.

There was also the problem with plasma-firewall, remove it, remove firewalld, flush the nfttables and reinstall firewalld, this worked for me.

37

Glad you got it going. No reason to be sorry, things happen, and we all learn from mistakes.