Firewall nfs tcp settings
Hugh Sparks
Version 1.9, June 23, 2006
This document shows how to install a minimal Cygwin enviroment to host an NFS server. I wrote this up to help windows users who are not familiar with Linux conventions so the fussy details are all presented.
If you're using Windows XP, be sure to check out the last sections on firewall and network device problems before you try testing your configuration.
Things often change in the Cygwin project and I only maintain this page when I update my own Cygwin and find the nfs server broken. You really must read the official nfs-server documentation and attempt to follow those directions because they take precidence over anything you read on this site. After installing Cygwin and the nfs-server (see below) you will find the documentation here:
/usr/share/doc/Cygwin/nfs-server-x.y.z.README
Please don't bother the cywin mailing lists or nfs-server maintainers until you have tried to follow the instructions in the official README.
If you find discrepancies between the README documentation and this HOWTO, I will very much appreciate an email from you. Please include the version of Cygwin and nfs-server you have installed.
You need a directory for the Cygwin installation. It seems to be lucky for this program to be at the top level of your C drive. If you feel adventurous, try putting it somewhere else, otherwise, create this directory:
c:\Cygwin
You will also need a place to archive the Cygwin packages. This should be where you keep other installers. For this example, we create the directory:
e:\CygwinInstaller
Enter this string in your browser's address bar:
http://www.cygwin.com/setup.exe
Download the installer (setup.exe) to:
e:\CygwinInstaller
Now run the setup.exe program. Press Next on the splash window and select
Install from Internet
Press Next.
Your root directory should be:
c:\Cygwin
Select: "Install For: All Users"
Select: "Default Text File Type: Unix"
Press Next.
Specify your local package directory: (for example)
e:\CygwinInstaller
Press Next. Select: "Direct Connection" Press Next.
Choosing a mirror is tricky. You want to find a fast one. I've had good luck with:
http://cygwin.get-software.com
Press Next.
If you have chosen wisely, a list of packages will
rapidly appear in the setup window.
Installing extra packages
Several packages are needed beyond the default installation. If you've been messing around, press the "View" button repeatedly to cycle through to the "Category" view.
Adding vim:
Click on the + sign next to the Editors category.
Scroll down to find the "vim" item and click on
the word "Skip." Each time you click in this area,
the text will change, scrolling through the available
versions of the package. Often, it is a good
idea to select the most recent version of the package.
For example, "6.2-3". The box in the "Bin?" column should
be checked automatically.
Adding nfs-server:
Click on the + sign next to the Net category.
Scroll down to find the nfs-server item and click on
the word "Skip" so it becomes "Install." Select a recent
version of the package.
Note: The nfs-server is fairly new, so if you don't see
it in the Net category, back out and try a different Cygwin
server.
Adding sunrpc:
This component is found in the Libs category.
Scroll down to find the sunrpc item and click on
the word "Skip" until it becomes "Install." Select
a recent version of the package.
Adding cygrunsrv:
This utility lets you configure the nfs server as a
Windows system service.
Click on the + sign next to the Admin category.
Scroll down to find the cygrunsrv item and click on
the word "Skip". Select a recent version of the package.
Press Next.
All your packages as well as any packages they require
will be downloaded and installed.
Run the configuration script
In the cygwin shell window, run:
/usr/bin/nfs-server-config
A number of warnings will appear about you installing cygwin for a single user, even though you didn't. You can ignore these complaints.
Editing the configuration files
You probably need to learn the "vi" editor so you can easily create or modify Cygwin configuration files without installing all of X-Windows to support a GUI editor. You will be annoyed if this is your first exposure to vi. Give in. Learn it. It Is Your Destiny.
Otherwise, use Notepad and find some way to convert from windows to unix text format. (Try the drag-n-drop programs uf2d and df2u.)
Host access control files
If you perform the installation of cygwin as described above, you will not need to edit /etc/hosts.allow or /etc/hosts.deny. If you have installed tcp-wrappers by accident or because you decided to install everything, you will need to edit them:
Edit:
/etc/hosts.allow
To enable access by just one host:
nfsd: 148.150.62.152
To enable an entire subnet:
nfsd: 148.150.0.0/255.255.0.0
Edit
/etc/hosts.deny
Comment out any lines that appear in this file. It will be empty unless you have chosen to install other Cygwin network packages.
The hosts.allow and hosts.deny files support more complex authorization schemes. See "man hosts_acccess" and "man hosts_options" if you need more precise control.
Export directories
Edit:
/etc/exports
This is where you export local directories.
This example exports the /pub directory to everyone in the 148.150.62 subnet.
/pub 148.150.62.0/255.255.255.0(ro, no_root_squash)
The option "ro" means read-only. Use "rw" for read-write.
You cannot use the wildcard "*" in host numbers:
No: 148.150.62.*
You can use the wild card in host names:
Yes: *.mts.com
To use ip names, the name must be a real DNS name or it must in your /etc/hosts file.
Note: The Cygwin hosts file: /etc/hosts is actually a shortcut to your windows hosts file at:
c:\winnt\system32\drivers\etc\hosts
For some reason, nfs mounts are MUCH faster if you don't authorize entire subnets. It is better to list specific hosts.
Per-user authorization
If the user and group numbers on the client machine match those of an authorized user on the server, access is allowed based on the privilages granted to the user on the server.
Note: You can only have users & permissions in Cygwin if you are using NTFS in windows. If you have FAT32, you must connect as root from the remote system.
The root account is special. Access is never allowed to remote root users unless the "no_root_squash" option is used (as shown in the example above.)
The easy way is to access the server from a client running as root and use the no_root_squash option.
Run:
Start Menu/Programs/Administrative Tools/Services Someone reported that with the Windows XP "Fisher Price" configuration, the Services menu has this path: Start Menu/Control Panel/Administrative Tools/Services
There are three services associated with NFS:
Cygwin mountd Cygwin nfsd Cygwin portmap
Right-click on each of these and use the pop-up menu to start all three servers. You will find that portmap starts automatically when you start either nfsd or mountd first. There is a dependency between system services that Windows tries to maintain automatically.
After editing any of the configuration files the /etc directory, you must restart these services. Because mountd and nfsd are configured to depend on portmap, it is sufficent to right-click on portmap and select "restart." A dialog will appear to confirm that you also want to restart mountd and nfsd.
The client machine in the following example is assumed to be a Linux or other Unix system. If you have a nice free NFS client for Windows, I'd like to hear about it so I can add a link on this page.
For this example, we assume that the NFS server running on your Windows machine has an ip name "remote" and an exported directory "/pub" defined under /etc/exports as shown above.
The name "remote" only has to be defined on the Linux/Unix client. You can define the name in /etc/hosts or just use the ip number of your Windows server in the following example.
Log into your client machine. You probably need to be "root" to mount the remote nfs directory.
Create a local directory:
mkdir /mnt/there
Mount the share:
mount -t nfs remote:/pub /mnt/there
You should now be able to poke around in /mnt/there, and see any files located in the "/pub" directory on the Cygwin/Windows side.
Important update: A reader of this HOWTO has discovered that CygwinNFS does not support NFS version 3, which is now the default in Linux. To overcome this problem you must add an option to the mount command line: "-overs=2" The full command line becomes:
mount -t nfs -o nfsvers=2 remote:/pub /mnt/there
An alternative specification using "vers" also works on Linux and other Unix-like systems:
mount -t nfs -o vers=2 remote:/pub /mnt/there
(Thanks to Mr. Ostrozhansky!)
If you run "mount" with no parameters in the cygwin shell, you will see a list of mounted directories.
The Windows root directories, c:\, d:\ etc will also appear in this list. They are accessed through the special path names /cygdrive/c, /cygdrive/d etc. If you visit the root "/" of cygwin, you will find that these mount points don't actually exist. If you try to list them in the nfs /etc/exports file, they will fail to mount on the client system.
This is probably a bug, but there is a simple work-around:
Create a directory for each Windows volume you want to export and then mount them directly to the windows pathname:
Make directories to use as mount points:
mkdir -p /mnt/c mkdir -p /mnt/d
Mount the windows directories:
mount c:/ /mnt/c mount d:/ /mnt/d
Now you can export these directories in /etc/exports:
/mnt/c myClient.com(rw, no_root_squash) /mnt/d myClient.com(rw, no_root_squash)
Don't forget to restart the portmap service in Windows.
You may be worried about what happens to your mounts when you reboot windows: They are stored in the registry, rather than /etc/fstab. After a reboot, they are restored and they will be available to remote systems via NFS.
In fact, if you reboot windows when an nfs mount was created on a remote client, the mounted files will still be available after windows reboots.
Stop the services:
cygrunsrv --stop mountd cygrunsrv --stop nfsd cygrunsrv --stop portmap
Remove the services:
cygrunsrv --remove mountd cygrunsrv --remove nfsd cygrunsrv --remove portmap
If you use Cygwin to run other services such as X-Windows, you should stop these processes now.
Exit the shell and run the Cygwin setup.exe Use the "View" button repeatedly to cycle to the "Category" view, then click on the "Default" text next to category "All" to cycle through until you see Uninstall.
Press Next-> to remove everthing.
Cygwin is one of those programs that doesn't really like to be uninstalled. To finish the job, delete everything in your c:\cygwin directory. You may find that you need to stop residual cygwin processes with the Task Damager before you can delete everthing in the Cygwin folder. Reboot if necessary.
Next, run Regedit and search for cygwin. Delete all the keys you find and any surrounding "Cygnus Solutions" folders.
Many people report trouble running the NFS server under Windows XP. Since service pack 2, XP has a firewall which will block NFS connections by default.
An additional difficulty occurs because the nfs system services won't start when certain network devices are enabled but disconnected.
Dealing with the firewall
You need to enable selected ports and programs to bypass Windows Firewall. The following windows show the required changes:
On each of the configuration windows shown above, there is a Change scope button. This brings up a window where you can restrict the action of opening the firewall to your local LAN. If you don't plan to operate NFS over the internet, this is a very good idea:
Dealing with conflicting network devices
The symptom this problem creates is that nfsd and mountd won't start. It appears that these services refuse to start if any network device is enabled but currently disconnected.
If you have a wireless lan card, bluetooth device or other network devices that are only occasionally connected, you will probably encounter problems running the nfs-server.
Here's a quick way to find out which network devices are blocking NFS: Bring up the System Services panel and locate the Cygwin portmap service. You can right-click on this item to bring up a menu that will allow you to restart the portmap. Because nfsd and mountd depend on portmap, they will offer to restart as well.
You can also right-click on devices displayed in the Device Manager panel. A menu pops up that will let you disable the selected device.
Go through the list and disable all the network devices except for the ones associated with your currently active connection(s). Then try restarting the portmap and see if nfsd and mountd start correctly. In every case I've seen or heard about, this strategy works.
The following Device Manager list shows the devices (with the red X) I needed to disable. When I need to use one of these devices, I can re-enable them and nfs continues to operate. (As long as it starts first.)
