I'm trying to configure nfs and printing for my local network. I got that working a few days ago, but now it seems lost. The firewall configuration I mean.
Take nfs. I had the server configured on one of the machines with the proper open ports, and I was able to access the nfs shares from other machines. Now I can't. In firewall-config I have mountd, nfs and rpc-bind checked in the public zone, hoping this would open up the ports. But
56) root:~> firewall-cmd --query-service=nfs && echo enabled enabled 57) root:~> firewall-cmd --query-port=2049/tcp && echo open 58) root:~>
Same with ipp:
61) root:~> firewall-cmd --query-service=ipp && echo enabled enabled 62) root:~> firewall-cmd --query-port=631/tcp && echo on 63) root:~>
So the service is enabled and the port isn't? What's the point of enabling services if it doesn't open the appropriate port? An nmap scan from another machine shows
111 tcp open 631 tcp closed 2049 tcp closed
Could someone help me understand what's going on? How come the portmapper (111) is open and 2049 is not? And what do I have to do to actually open ports 2049 and 631?
Also, is it possible and what's the command to list the firewall rules, as in
/sbin/iptables --list
To be sure, I did see the examples with --list-services, --list-ports, etc. I want to list the actual rules, if it's possible. Oh, yes, and define custom rules too.
Thanks!
On 07/12/13 10:15, Amadeus W.M. wrote:
So the service is enabled and the port isn't? What's the point of enabling services if it doesn't open the appropriate port? An nmap scan from another machine shows
111 tcp open 631 tcp closed 2049 tcp closed
Could someone help me understand what's going on? How come the portmapper (111) is open and 2049 is not? And what do I have to do to actually open ports 2049 and 631?
One question..... Is the nfs server running?
If you don't have the service enabled and you do a remote port scan you'll get....
PORT STATE SERVICE 2049/tcp filtered nfs
If you have the service enabled, but the server not running you'll get....
PORT STATE SERVICE 2049/tcp closed nfs
If you have the service enabled and the server running only then will you get...
PORT STATE SERVICE 2049/tcp open nfs
From the remote machine.....
On Fri, 12 Jul 2013 11:09:15 +0800, Ed Greshko wrote:
On 07/12/13 10:15, Amadeus W.M. wrote:
So the service is enabled and the port isn't? What's the point of enabling services if it doesn't open the appropriate port? An nmap scan from another machine shows
111 tcp open 631 tcp closed 2049 tcp closed
Could someone help me understand what's going on? How come the portmapper (111) is open and 2049 is not? And what do I have to do to actually open ports 2049 and 631?
One question..... Is the nfs server running?
Thanks, good catch! I too figured it wasn't running because nmap reports closed if the port is open, but nothing's listening on it. So I guess the firewall configuration survived a reboot, but starting nfs didn't. So this is needed:
systemctl enable nfs-server.service
Now on to printing.
43) root:~> systemctl status cups.service cups.service - CUPS Printing Service Loaded: loaded (/usr/lib/systemd/system/cups.service; enabled) Active: active (running) since Wed 2013-07-10 03:06:21 EDT; 1 day 20h ago Main PID: 1330 (cupsd) CGroup: name=systemd:/system/cups.service └─1330 /usr/sbin/cupsd -f
Jul 11 08:29:47 alpha systemd[1]: Started CUPS Printing Service. Jul 11 08:30:09 alpha systemd[1]: Started CUPS Printing Service. Jul 11 14:15:18 alpha systemd[1]: Started CUPS Printing Service. Jul 11 14:15:18 alpha systemd[1]: Started CUPS Printing Service. Jul 11 14:15:26 alpha systemd[1]: Started CUPS Printing Service. Jul 11 14:17:00 alpha systemd[1]: Started CUPS Printing Service. Jul 11 14:17:01 alpha systemd[1]: Started CUPS Printing Service. Jul 11 14:17:10 alpha systemd[1]: Started CUPS Printing Service. Jul 11 18:54:55 alpha systemd[1]: Started CUPS Printing Service. Jul 11 18:54:55 alpha systemd[1]: Started CUPS Printing Service.
# so cups is running and I do have printers configured
44) root:~> netstat -tupan | grep cups tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1330/cupsd tcp6 0 0 ::1:631 :::* LISTEN 1330/cupsd
# I turned the firewall off
45) root:~> firewall-cmd --state not running
Yet nmap on another machine shows sshd and nfs open, but shows absolutely nothing about port 631.
And on that same (redhat) machine, system-config-printer does not see nor does it find any network printer.
On 07/12/13 11:52, Ed Greshko wrote:
On 07/12/13 11:41, Amadeus W.M. wrote:
- root:~> netstat -tupan | grep cups
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1330/cupsd
cupsd is listening only on 127.0.0.1
This is the default.... From the /etc/cups/cupsd.conf
# Only listen for connections from the local machine. Listen localhost:631 Listen /var/run/cups/cups.sock
- root:~> netstat -tupan | grep cups tcp 0 0 127.0.0.1:631 0.0.0.0:*
LISTEN 1330/cupsd tcp6 0 0 ::1:631 :::* LISTEN 1330/cupsd
Figured this one out too. Looks like by default cupsd was listening on the localhost only (127.0.0.1). Changed that in /etc/cups/cupsd.conf to
Listen *:631
On 07/12/13 12:03, Amadeus W.M. wrote:
Figured this one out too. Looks like by default cupsd was listening on the localhost only (127.0.0.1). Changed that in /etc/cups/cupsd.conf to
OK.... So, the lesson to be learned is..... Don't respond to your queries quickly. :-) :-)
On 07/11/2013 10:41 PM, Amadeus W.M. wrote:
On Fri, 12 Jul 2013 11:09:15 +0800, Ed Greshko wrote:
One question..... Is the nfs server running?
Thanks, good catch! I too figured it wasn't running because nmap reports closed if the port is open, but nothing's listening on it. So I guess the firewall configuration survived a reboot, but starting nfs didn't. So this is needed:
systemctl enable nfs-server.service
On Fedora 19, you also need to do:
systemctl enable nfs.target
See https://bugzilla.redhat.com/show_bug.cgi?id=769879.