How to Allow NFS Through the Firewall on a GroupWise Server for OpenText Reload
OpenText Reload uses NFS to access GroupWise data during backup operations. When the firewall is enabled on the GroupWise server, Reload may fail to connect even though NFS itself is running correctly.
The underlying issue is that NFSv3 relies on several RPC services. Some of these services use dynamically assigned ports by default. Those ports can change after a service restart or server reboot, which makes it difficult to create reliable firewall rules.
The solution is to configure the dynamic RPC services to use static ports, then permanently allow those ports through the firewall.
Understanding the Default Dynamic Port Configuration
The following example shows the output of rpcinfo -p on a SLES 15 server using the default NFS configuration:
mhcfs02:/etc/sysconfig # rpcinfo -p
program vers proto port service
100000 4 tcp 111 portmapper
100000 3 tcp 111 portmapper
100000 2 tcp 111 portmapper
100000 4 udp 111 portmapper
100000 3 udp 111 portmapper
100000 2 udp 111 portmapper
100005 1 udp 20048 mountd
100005 1 tcp 20048 mountd
100005 2 udp 20048 mountd
100005 2 tcp 20048 mountd
100005 3 udp 20048 mountd
100005 3 tcp 20048 mountd
100024 1 udp 43546 status
100024 1 tcp 39303 status
100003 3 tcp 2049 nfs
100003 4 tcp 2049 nfs
100227 3 tcp 2049 nfs_acl
100021 1 udp 39161 nlockmgr
100021 3 udp 39161 nlockmgr
100021 4 udp 39161 nlockmgr
100021 1 tcp 46033 nlockmgr
100021 3 tcp 46033 nlockmgr
100021 4 tcp 46033 nlockmgr
The important ports in this output are:
| Service | Protocol | Current Port | Behavior |
|---|---|---|---|
| rpcbind / portmapper | TCP and UDP | 111 | Fixed |
| rpc.mountd | TCP and UDP | 20048 | May be dynamically assigned unless explicitly configured |
| rpc.statd | UDP | 43546 | Dynamic |
| rpc.statd | TCP | 39303 | Dynamic |
| NFS | TCP | 2049 | Fixed |
| nlockmgr / lockd | UDP | 39161 | Dynamic |
| nlockmgr / lockd | TCP | 46033 | Dynamic |
Notice that services such as rpc.statd and nlockmgr are using high-numbered ports that appear somewhat random. The TCP and UDP ports may also be different from each other.
These values can change after NFS services are restarted or after the server is rebooted. A firewall rule created for port 39303, for example, may stop working later if rpc.statd starts on a different port.
This is why the ports should be explicitly configured before creating the firewall rules.
Configure Static NFS Ports on SLES 15
Edit the following file:
vi /etc/sysconfig/nfs
Locate and configure the following values:
MOUNTD_PORT="2048"
STATD_PORT="32765"
LOCKD_TCPPORT="32767"
LOCKD_UDPPORT="32767"
These settings assign predictable ports to the NFS RPC services that would otherwise use dynamically assigned ports.
| Service | Configuration Setting | Static Port |
|---|---|---|
| rpc.mountd | MOUNTD_PORT |
2048 TCP and UDP |
| rpc.statd | STATD_PORT |
32765 TCP and UDP |
| lockd / nlockmgr | LOCKD_TCPPORT |
32767 TCP |
| lockd / nlockmgr | LOCKD_UDPPORT |
32767 UDP |
| rpcbind / portmapper | No change required | 111 TCP and UDP |
| NFS server | No change required | 2049 TCP and UDP |
Restart the NFS Services
After saving the changes, restart the NFS server:
systemctl restart nfs-server
If necessary, restart the individual supporting services:
systemctl restart nfs-mountd
systemctl restart rpc-statd
systemctl restart nfs-server
The exact service names available may vary slightly by SLES 15 service pack.
Verify the Static Ports
Run:
rpcinfo -p
The relevant services should now appear on the configured ports:
program vers proto port service
100000 4 tcp 111 portmapper
100000 4 udp 111 portmapper
100005 3 tcp 2048 mountd
100005 3 udp 2048 mountd
100003 3 tcp 2049 nfs
100024 1 tcp 32765 status
100024 1 udp 32765 status
100021 4 tcp 32767 nlockmgr
100021 4 udp 32767 nlockmgr
The important point is that these values should remain the same after the services are restarted.
Configure the Firewall
Use the built-in firewalld services for rpc-bind and nfs. These services allow the standard ports used by rpcbind and the NFS server.
firewall-cmd --permanent --add-service=rpc-bind
firewall-cmd --permanent --add-service=nfs
Then allow the statically configured RPC ports:
firewall-cmd --permanent --add-port=2048/tcp
firewall-cmd --permanent --add-port=2048/udp
firewall-cmd --permanent --add-port=32765/tcp
firewall-cmd --permanent --add-port=32765/udp
firewall-cmd --permanent --add-port=32767/tcp
firewall-cmd --permanent --add-port=32767/udp
Reload the firewall configuration:
firewall-cmd --reload
Complete Firewall Command Set
firewall-cmd --permanent --add-service=rpc-bind
firewall-cmd --permanent --add-service=nfs
firewall-cmd --permanent --add-port=2048/tcp
firewall-cmd --permanent --add-port=2048/udp
firewall-cmd --permanent --add-port=32765/tcp
firewall-cmd --permanent --add-port=32765/udp
firewall-cmd --permanent --add-port=32767/tcp
firewall-cmd --permanent --add-port=32767/udp
firewall-cmd --reload
Port 2048/udp is particularly important. During testing, the NFS client attempted to contact rpc.mountd over UDP before attempting TCP. If UDP port 2048 is blocked, the mount may pause, fail, or depend on the client successfully falling back to TCP.
Verify the Firewall Configuration
Display the active firewall zone:
firewall-cmd --get-active-zones
Display the configured services and ports:
firewall-cmd --list-services
firewall-cmd --list-ports
A more complete view can be displayed with:
firewall-cmd --list-all
The output should include:
services: nfs rpc-bind
ports: 2048/tcp 2048/udp 32765/tcp 32765/udp 32767/tcp 32767/udp
Verify Connectivity from the Reload Server
From the OpenText Reload server, confirm that the GroupWise server is advertising the expected RPC ports:
rpcinfo -p <groupwise-server-ip>
Display the available NFS exports:
showmount -e <groupwise-server-ip>
Create a temporary mount point:
mkdir -p /mnt/test
Test the NFSv3 mount:
mount -v -t nfs -o vers=3 <groupwise-server-ip>:/gw /mnt/test
Verify that the export is mounted:
mount | grep /mnt/test
ls -la /mnt/test
Unmount the test share when finished:
umount /mnt/test
Troubleshooting
No Route to Host
A message such as the following often indicates that the firewall is rejecting the connection:
RPC: Unable to receive - No route to host
This does not necessarily mean that the server is unreachable. It may mean that one specific RPC port is blocked.
Client Stops While Trying UDP Port 2048
If the mount output stops or pauses at:
mount.nfs: trying <server> prog 100005 vers 3 prot UDP port 2048
verify that 2048/udp is allowed through the firewall.
Access Denied by Server
If the client reaches the NFS services but receives:
mount.nfs: access denied by server while mounting
the firewall is no longer the primary problem. Verify the NFS export in:
/etc/exports
For example:
/gw/ 192.168.1.224(rw,no_root_squash,sync,fsid=1)
Apply changes to the export configuration with:
exportfs -ra
exportfs -v
Summary
NFSv3 depends on several RPC services. Ports 111 and 2049 are fixed, but rpc.mountd, rpc.statd, and nlockmgr may use dynamic ports by default.
To make OpenText Reload work reliably through the GroupWise server firewall:
- Configure static RPC ports in
/etc/sysconfig/nfs. - Restart the NFS services.
- Verify the ports with
rpcinfo -p. - Allow the
rpc-bindandnfsfirewall services. - Allow TCP and UDP ports 2048, 32765, and 32767.
- Reload the firewall.
- Test the NFS mount from the Reload server.