Re: NFS daemon port numbers for firewall config

[Lloyd Parkes <lloyd%must-have-coffee.gen.nz@localhost>]

On Fri, 2024-04-19 at 21:27 +0000, Taylor R Campbell wrote:
> 
> Am I missing any existing way to do this?
> 

Sort of. 

Some firewall implementations can be extended with code that parses the
allowed traffic in order to open up more ports. The traditional example
is active FTP where the control port is well known while the data port
is random and goes the "wrong" way. e.g. NPF calls these "application
level gateways". This code is normally compiled into the kernel.

You could have a portmapper application in your firewall that
dynamically opens RPC ports when it sees permitted portmapper traffic
listing those ports. Getting this right will require thought and
attention to detail.

Most people just stick to using fixed port numbers. Sometimes they use
modest port ranges where a single port might have performance issues.

Ngā mihi,
Lloyd