rsh, nfs and firewall

[Admin.SIF]

Hello,
Which ports should I open to allow rsh through a firewall?
What about NFS ? I read something about dynamic ports for mountd so I don't know if we can make nfs secure through a firewall by managing ports by the firewall.
Thank you

[Mark Poeschl_2]

rsh is port 514. NFS can indeed be problematic since it inherently uses RPC calls which dynamically allocate port numbers. If your firewall package has specific capability around filtering on RPC programs you might be able to make it work.

[Admin.SIF]

Thank you.
For NFS, it was working for more than 2 years. Recently we replaced the protocol udp by tcp and did a shutdown/reboot of the NFS server and since that reboot, it doesn't work any more.
For rsh, we have opened the port 514 but the command rsh from the other host come with port 1022 or 1023 and is refused. I think that they use ssh instead of rsh.
Any idee please?

[Mark Poeschl_2 · Accepted solution]

I think you're getting confused between client and server port numbers. For rsh, the client will issue a connect request from any randomly available port number to server port 514. To get rsh to work what you need to open on your firewall is traffic from to <514> and vice versa.

As I said NFS will be problematic because it uses RPC.