NFS root + iptables in 2.6.25

NFS root + iptables in 2.6.25

[Wojciech Kromer]

Hi.

I'm using nfs root filesystem for developing.
On 2.6.23 everything works fine, but on 2.6.25 loading any iptables
module causes problems:


# modprobe iptable_nat
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
nfs: RPC call returned error 1
nfs: RPC call returned error 1
nfs: RPC call returned error 1
nfs: RPC call returned error 1
nfs: RPC call returned error 1
nfs: RPC call returned error 1


Probably iptables changed it's default behavior from "allow all" to
"deny all" at startup.
Is there any way to change it back?
I can't change anything after loading any iptable module, because all
programs on filesystem are not accessible after loading...


Regards.

Re: NFS root + iptables in 2.6.25

[Richard A Nelson]

On Fri, 19 Sep 2008, Wojciech Kromer wrote:

> # modprobe iptable_nat
> nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
> nfs: RPC call returned error 1
>
> Probably iptables changed it's default behavior from "allow all" to
> "deny all" at startup.
> Is there any way to change it back?
> I can't change anything after loading any iptable module, because all
> programs on filesystem are not accessible after loading...

NFS and iptables definitely takes some care - and there are still holes
- no way to specify ports for all requests...

but this seems odd...  you must've had some extant rules that suddenly
seemingly changed behaviour before the modprobe was done


-- 
Rick Nelson
[In 'Doctor' mode], I spent a good ten minutes telling Emacs what I
thought of it.  (The response was, 'Perhaps you could try to be less
abusive.')
 		-- Matt Welsh

Re: NFS root + iptables in 2.6.25

[Wojciech Kromer]

>
> NFS and iptables definitely takes some care - and there are still holes
> - no way to specify ports for all requests...
>
> but this seems odd...  you must've had some extant rules that suddenly
> seemingly changed behaviour before the modprobe was done
>
>
it was first module loaded

Re: NFS root + iptables in 2.6.25

[Andrew Morton]

On Fri, 19 Sep 2008 08:22:21 +0200 Wojciech Kromer <wojciech.kromer@dgt.com.pl> wrote:

> Hi.
> 
> I'm using nfs root filesystem for developing.
> On 2.6.23 everything works fine, but on 2.6.25 loading any iptables
> module causes problems:
> 
> 
> # modprobe iptable_nat
> nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
> nfs: RPC call returned error 1
> nfs: RPC call returned error 1
> nfs: RPC call returned error 1
> nfs: RPC call returned error 1
> nfs: RPC call returned error 1
> nfs: RPC call returned error 1
> 
> 
> Probably iptables changed it's default behavior from "allow all" to
> "deny all" at startup.
> Is there any way to change it back?
> I can't change anything after loading any iptable module, because all
> programs on filesystem are not accessible after loading...
> 
> 

(cc's added)

(googles "nfs: RPC call returned error 1")

hm, there has been a dribble of reports going back several years, but
nothing conclusive afaict.