*.m4: Actually allow NFS to untrusted hosts.

Some NFS servers are configured to allow mounts from untrusted hosts,
but the firewall won't let them.  Fix this.

diff --git a/jem.m4 b/jem.m4
index 5f7924891b4edf98fd44d85470bb3bc26a958288..ecbed74eef03325e520ac0f43c3c9b9ac5cd615f 100644 (file)
--- a/jem.m4
+++ b/jem.m4
@@ -40,6 +40,11 @@ allowservices inbound tcp \
        http https rsync \
        git
 
        http https rsync \
        git
 

+allowservices inbound-untrusted tcp \
+       sunrpc mount nfs
+allowservices inbound-untrusted udp \
+       sunrpc mount nfs
+

 ## Provide DNS resolution to local untrusted hosts.
 for p in tcp udp; do
   run ip46tables -A inbound -j ACCEPT \
 ## Provide DNS resolution to local untrusted hosts.
 for p in tcp udp; do
   run ip46tables -A inbound -j ACCEPT \

diff --git a/numbers.m4 b/numbers.m4
index 456ff845bdc365d0f43d33b8258d0cf4de72c3dc..32df3398e62b6f97f39d5b7fbb3b1e01b49edfab 100644 (file)
--- a/numbers.m4
+++ b/numbers.m4
@@ -36,6 +36,7 @@ defport bootpc 68
 defport tftp 69
 defport finger 79
 defport http 80
 defport tftp 69
 defport finger 79
 defport http 80

+defport sunrpc 111

 defport ident 113
 defport netbios_ns 137
 defport netbios_dgm 138
 defport ident 113
 defport netbios_ns 137
 defport netbios_dgm 138


@@ -51,6 +52,7 @@ defport rsync 873
 defport ftps 990
 defport imaps 993
 defport h323 1720
 defport ftps 990
 defport imaps 993
 defport h323 1720

+defport nfs 2049

 defport ssquid 3127
 defport squid 3128
 defport icp 3130
 defport ssquid 3127
 defport squid 3128
 defport icp 3130


@@ -70,6 +72,7 @@ defport pgp_keys 11371
 defport i2p 16911
 defport disorder2 23598
 defport disorder 23599
 defport i2p 16911
 defport disorder2 23598
 defport disorder 23599

+defport mount 32767

 defport udpkey 59274
 
 ## Protocol numbers.
 defport udpkey 59274
 
 ## Protocol numbers.

diff --git a/roadstar.m4 b/roadstar.m4
index 5485d0046e91e9fc53d9459479a62945cb084315..61b0aa9676f556b7c5fc1eda547035276f4231b3 100644 (file)
--- a/roadstar.m4
+++ b/roadstar.m4
@@ -33,6 +33,11 @@ allowservices inbound tcp \
        rsync \
        http https squid
 
        rsync \
        http https squid
 

+allowservices inbound-untrusted tcp \
+       sunrpc mount nfs
+allowservices inbound-untrusted udp \
+       sunrpc mount nfs
+

 ## Provide DNS resolution to local untrusted hosts.
 for p in tcp udp; do
   run ip46tables -A inbound-untrusted -j ACCEPT \
 ## Provide DNS resolution to local untrusted hosts.
 for p in tcp udp; do
   run ip46tables -A inbound-untrusted -j ACCEPT \

diff --git a/telecaster.m4 b/telecaster.m4
index b9f1069147c7b17dcb24f09758ef6c35bc7ad84d..103d11b146514bfd9e0f08f06ec1326208e4209e 100644 (file)
--- a/telecaster.m4
+++ b/telecaster.m4
@@ -34,6 +34,11 @@ allowservices inbound tcp \
        rsync \
        http https squid ssquid
 
        rsync \
        http https squid ssquid
 

+allowservices inbound-untrusted tcp \
+       sunrpc mount nfs
+allowservices inbound-untrusted udp \
+       sunrpc mount nfs
+

 run iptables -A inbound -j ACCEPT \
        -p udp --destination-port $port_icp \
        -m limit --limit 10/second --limit-burst 100
 run iptables -A inbound -j ACCEPT \
        -p udp --destination-port $port_icp \
        -m limit --limit 10/second --limit-burst 100