Networker 7.6.3 client redhat firewall config

Hi rowanr,

Normally during the installation, the firewall exclusions are created for the NetWorker without any manual modifications needed, but anyway are you able to telnet from the backup server that client on port 7937 and 7938 ?

Use the command rpcinfo -p machinename  in both ways, from backup server to the client and vice versa to check the communication between the hosts.

Hope this helps,

Ahmed Bahaa

Hi Ahmed,

Thanks for your reply, I've had to drop the firewall for the moment to allow the backups to continue (so no point really running those tests).  When I installed the rpm I didn't see any firewall rules being created (can you paste the default rules in the thread for me?), I had to allow everything from the backup server so that it could connect, but I think I have a problem with my output rule, as it didn't backup.

I was hoping someone could paste or link me to the correct working rules so that I can reuse them for my config.

Cheers,

Rowan

Hi Rowan,

How is the rpcinfo command going after enabling the firewall on the client ? Are you able to telnet the ports i mentioned in two ways (backup server to client and vice versa ) ?

Thanks,

Ahmed Bahaa

Hi Ahmed,

I have amended the rules and run the rpcinfo command;

[root@backupclient ~]# rpcinfo -p backupserver

   program vers proto   port

    100000    4   tcp    111  portmapper

    100000    3   tcp    111  portmapper

    100000    2   tcp    111  portmapper

    100000    4   udp    111  portmapper

    100000    3   udp    111  portmapper

    100000    2   udp    111  portmapper

    100024    1   udp  32776  status

    100024    1   tcp  32771  status

    100133    1   udp  32776

    100133    1   tcp  32771

    100021    1   udp   4045  nlockmgr

    100021    2   udp   4045  nlockmgr

    100021    3   udp   4045  nlockmgr

    100021    4   udp   4045  nlockmgr

1073741824    1   tcp  32772

    100021    1   tcp   4045  nlockmgr

    100021    2   tcp   4045  nlockmgr

    100021    3   tcp   4045  nlockmgr

    100021    4   tcp   4045  nlockmgr

    300598    1   udp  32789

    300598    1   tcp  32773

805306368    1   udp  32789

805306368    1   tcp  32773

    100249    1   udp  32824

    100249    1   tcp  32774

    390436    1   tcp   9816

    390435    1   tcp   9324

    390113    1   tcp   7937  nsrexecd

    390103    2   tcp   8968  nsrd

    390109    2   tcp   8968  nsrstat

    390110    1   tcp   8968  nsrjbd

    390120    1   tcp   8968

    390109    2   udp   8492  nsrstat

    390107    5   tcp   8917  nsrmmdbd

    390107    6   tcp   8917  nsrmmdbd

    390105    5   tcp   9362  nsrindexd

    390105    6   tcp   9362  nsrindexd

    390430    1   tcp   9197  nsrmmgd

    390104 1205   tcp   9154  nsrmmd

    390104 2205   tcp   9532  nsrmmd

    390402    1   tcp   9001

    390104 3305   tcp   8575  nsrmmd

    390104 3405   tcp   8558  nsrmmd

    390104 3505   tcp   9309  nsrmmd

    390104 3605   tcp   9291  nsrmmd

    390104 3705   tcp   9274  nsrmmd

    390104 3805   tcp   9257  nsrmmd

    390104 3905   tcp   9239  nsrmmd

    390104 4005   tcp   9222  nsrmmd

    39010411005   tcp   9254  nsrmmd

    390433    1   tcp   9593  nsrjobd

The backup server is not able to connect to the client;

backupserver:~# rpcinfo -p backupclient
^C

So it looks like a problem with the input rule....

Hi Rowanr,

Yes, the issue now seems to be in the direction from the backup server to the client. You have to check the inbound rules.

Waiting your updates.

Thanks,

Ahmed Bahaa

Hi rowanr,

How is the issue going ? Did you managed to solve the inbound rules ?

Waiting your updates,

Ahmed Bahaa

Hi,

I still need help with this, I'm wondering if I need to add NEW to the ESTABLISHED, RELATED command, it depends if the Networker client initiates a new connection once it is contacted by the backup server?

Thanks,

Rowan

Long time ago, rule of thumb for Linux systems used to be:

1. Enable RPC service monitoring on NetWorker portmapper: Define NetWorker base communication /etc/modprobe.conf options ip_conntrack_rsh range=16383 ports=7937 options ip_conntrack_rpc_tcp nsrexec=7937 ports=7938 options ip_conntrack_rpc_udp ports=7938 options ipt_rpc ports=7938 And load modules # modprobe ip_conntrack_rsh # modprobe ip_conntrack_rpc_tcp # modprobe ip_conntrack_rpc_udp # modprobe ipt_rpc 2. Add initial NetWorker portmapper and client connectivity: # iptables -A INPUT -j ACCEPT -p tcp -m state --state NEW -m tcp --dport 7937 # iptables -A INPUT -j ACCEPT -p tcp -m state --state NEW -m tcp --dport 7938 # iptables -A INPUT -j ACCEPT -p udp -m state --state NEW -m udp --dport 7938 3. Allow all communication on valid sessions only: # iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT # iptables -A INPUT -m state --state RELATED -j ACCEPT 4. Allow NetWorker daemons: The following rule is sufficient for the standard backup server: # iptables -A INPUT -m rpc --rpcs 390103, 390104, 390105, 390107, 390109, 390110, 390113 -j ACCEPT # iptables -A INPUT -m rpc --rpcs 390115, 390120, 390402, 390433, 390435, 390436, 390109 -j ACCEPT