From owner-freebsd-net@FreeBSD.ORG Sat Jun 16 05:40:40 2007 Return-Path: X-Original-To: freebsd-net@FreeBSD.org Delivered-To: freebsd-net@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 0EB7B16A400 for ; Sat, 16 Jun 2007 05:40:40 +0000 (UTC) (envelope-from bright@elvis.mu.org) Received: from elvis.mu.org (elvis.mu.org [192.203.228.196]) by mx1.freebsd.org (Postfix) with ESMTP id F1A9713C45A for ; Sat, 16 Jun 2007 05:40:39 +0000 (UTC) (envelope-from bright@elvis.mu.org) Received: by elvis.mu.org (Postfix, from userid 1192) id 134131A4D8B; Fri, 15 Jun 2007 22:40:05 -0700 (PDT) Date: Fri, 15 Jun 2007 22:40:05 -0700 From: Alfred Perlstein To: Jeremie Le Hen Message-ID: <20070616054005.GU96936@elvis.mu.org> References: <20070615072734.GC8093@obiwan.tataz.chchile.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20070615072734.GC8093@obiwan.tataz.chchile.org> User-Agent: Mutt/1.4.2.2i Cc: freebsd-net@FreeBSD.org Subject: Re: Firewalling NFS X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Jun 2007 05:40:40 -0000 * Jeremie Le Hen [070615 01:07] wrote: > Hi, > > It appears nearly impossible to firewall a NFS server on FreeBSD. I would be nearly impossible if one didn't know much about NFS. Care to rephrase your assertion? > The reason is that NFS related daemons use RPC, which means they > don't bind to a deterministic port. Only mountd(8) can be requested to > bind to a specific port or fail with the -p command-line switch. > Is there any reason other than "no one has needed this yet" why this > option is not available for nfsd(8), rpc.lockd(8) and rpc.statd(8)? this is wrong, wrong and more wrong. -- - Alfred Perlstein