11.23 - that's good news.
If you have installed patch PHNE_34550 and PHNE_34551 (or any patches that supersede them) you can add the following lines to the /etc/rc.config.d/nfsconf file on the NFS server:
LOCKD_PORT=
STATD_PORT=
MOUNTD_PORT=
This allows you to configure static port numbers for rpc.lockd, rpc.statd and rpc.mountd. This means they will always start using the same port numbers, which makes configuring a firewall infinitely easier than before these fixes.
I recommend setting LOCKD_PORT to 4045 since that is the industry standard port number for rpc.lockd. I would then set STATD_PORT to 4046 and rpc.mountd to 4047. Like this:
LOCKD_PORT=4045
STATD_PORT=4046
MOUNTD_PORT=4047
Then you stop/start the nfs.client and nfs.server scripts:
# /sbin/init.d/nfs.server stop
# /sbin/init.d/nfs.client stop
# /sbin/init.d/nfs.client start
# /sbin/init.d/nfs.server start
and the newly running rpc.lockd, rpc.mountd and rpc.statd should be using the static port numbers. You can confirm this with an rpcinfo -p command, like this:
# rpcinfo -p
program vers proto port service
100000 4 tcp 111 rpcbind
100000 3 tcp 111 rpcbind
100000 2 tcp 111 rpcbind
100000 4 udp 111 rpcbind
100000 3 udp 111 rpcbind
100000 2 udp 111 rpcbind
100024 1 udp 4046 status
100024 1 tcp 4046 status
100020 1 udp 4045 llockmgr
100020 1 tcp 4045 llockmgr
100021 1 udp 4045 nlockmgr
100021 3 udp 4045 nlockmgr
100021 4 udp 4045 nlockmgr
100021 1 tcp 4045 nlockmgr
100021 3 tcp 4045 nlockmgr
100021 4 tcp 4045 nlockmgr
100021 2 tcp 4045 nlockmgr
100005 1 udp 4047 mountd
100005 3 udp 4047 mountd
100005 1 tcp 4047 mountd
100005 3 tcp 4047 mountd
100003 2 udp 2049 nfs
100003 3 udp 2049 nfs
100003 2 tcp 2049 nfs
100003 3 tcp 2049 nfs
As you can see, the daemons are now registering at the configured ports. You also need to include ports 111 (rpcbind) and 2049 (nfsd). These patches make configuring a firewall or IP Filter much easier than without them.
Regards,
Dave
I work at HPE
HPE Support Center offers support for your HPE services and products when and how you need it. Get started with
HPE Support Center today.
[Any personal opinions expressed are mine, and not official statements on behalf of Hewlett Packard Enterprise]