Centos 7 NFS 防火墙(Iptables)配置

通过命令 rpcinfo -p 可查看nfs使用的端口:
[root@kbasnfs ~]# rpcinfo -p
program vers proto port service
100000 4 tcp 111 portmapper
100000 3 tcp 111 portmapper
100000 2 tcp 111 portmapper
100000 4 udp 111 portmapper
100000 3 udp 111 portmapper
100000 2 udp 111 portmapper
100005 1 udp 1011 mountd
100024 1 udp 51889 status
100005 1 tcp 1011 mountd
100024 1 tcp 38504 status
100005 2 udp 1011 mountd
100005 2 tcp 1011 mountd
100005 3 udp 1011 mountd
100005 3 tcp 1011 mountd
100003 3 tcp 2049 nfs
100003 4 tcp 2049 nfs
100227 3 tcp 2049 nfs_acl
100003 3 udp 2049 nfs
100003 4 udp 2049 nfs
100227 3 udp 2049 nfs_acl
100021 1 udp 57199 nlockmgr
100021 3 udp 57199 nlockmgr
100021 4 udp 57199 nlockmgr
100021 1 tcp 43554 nlockmgr
100021 3 tcp 43554 nlockmgr
100021 4 tcp 43554 nlockmgr
[root@kbasnfs ~]#

需要配置/etc/sysconfig/nfs 使 rquotad nlockmgr mountd 的端口固定，自己设定。

重启nfs服务。

[root@kbasnfs ~]# rpcinfo -p
program vers proto port service
100000 4 tcp 111 portmapper
100000 3 tcp 111 portmapper
100000 2 tcp 111 portmapper
100000 4 udp 111 portmapper
100000 3 udp 111 portmapper
100000 2 udp 111 portmapper
100005 1 udp 1092 mountd
100005 1 tcp 1092 mountd
100005 2 udp 1092 mountd
100005 2 tcp 1092 mountd
100005 3 udp 1092 mountd
100005 3 tcp 1092 mountd
100024 1 udp 662 status
100024 1 tcp 662 status
100003 3 tcp 2049 nfs
100003 4 tcp 2049 nfs
100227 3 tcp 2049 nfs_acl
100003 3 udp 2049 nfs
100003 4 udp 2049 nfs
100227 3 udp 2049 nfs_acl
100021 1 udp 12769 nlockmgr
100021 3 udp 12769 nlockmgr
100021 4 udp 12769 nlockmgr
100021 1 tcp 12803 nlockmgr
100021 3 tcp 12803 nlockmgr
100021 4 tcp 12803 nlockmgr
[root@kbasnfs ~]#

开启端口：
firewall-cmd --permanent --add-rich-rule=“rule family=“ipv4” source address=“192.168.61.0/24” port protocol=“tcp” port=“111” accept”
firewall-cmd --permanent --add-rich-rule=“rule family=“ipv4” source address=“192.168.61.0/24” port protocol=“udp” port=“111” accept”
firewall-cmd --permanent --add-rich-rule=“rule family=“ipv4” source address=“192.168.61.0/24” port protocol=“tcp” port=“1092” accept”
firewall-cmd --permanent --add-rich-rule=“rule family=“ipv4” source address=“192.168.61.0/24” port protocol=“udp” port=“1092” accept”
firewall-cmd --permanent --add-rich-rule=“rule family=“ipv4” source address=“192.168.61.0/24” port protocol=“tcp” port=“662” accept”
firewall-cmd --permanent --add-rich-rule=“rule family=“ipv4” source address=“192.168.61.0/24” port protocol=“udp” port=“662” accept”
firewall-cmd --permanent --add-rich-rule=“rule family=“ipv4” source address=“192.168.61.0/24” port protocol=“tcp” port=“2049” accept”
firewall-cmd --permanent --add-rich-rule=“rule family=“ipv4” source address=“192.168.61.0/24” port protocol=“udp” port=“2049” accept”
firewall-cmd --permanent --add-rich-rule=“rule family=“ipv4” source address=“192.168.61.0/24” port protocol=“tcp” port=“12769” accept”
firewall-cmd --permanent --add-rich-rule=“rule family=“ipv4” source address=“192.168.61.0/24” port protocol=“udp” port=“12769” accept”
firewall-cmd --permanent --add-rich-rule=“rule family=“ipv4” source address=“192.168.61.0/24” port protocol=“tcp” port=“12803” accept”
firewall-cmd --permanent --add-rich-rule=“rule family=“ipv4” source address=“192.168.61.0/24” port protocol=“udp” port=“12803” accept”
firewall-cmd --reload