This is one way to determine the ports needed to open in your iptables rules to get NFS to work properly. First we need to determine the ports NFS uses

rpcinfo -p | awk -F " " '{print $3 ", " $4 ", " $5}' | sort | uniq

Notice!
Since portmap assigns ports on random this example is only valid as long as you don’t restart your NFS.

On my system, a RedHat Enterprise Linux WS 4, the result was

proto, port,
tcp, 111, portmapper
tcp, 2049, nfs
tcp, 32771, nlockmgr
tcp, 768, rquotad
tcp, 782, mountd
udp, 111, portmapper
udp, 2049, nfs
udp, 32768, nlockmgr
udp, 765, rquotad
udp, 779, mountd

This gave me a nice overview of protocols (tcp/udp) and ports used.

Now the rules

iptables -A RH-Firewall-1-INPUT -s 192.168.0.0/255.255.255.0 -i eth0 -p tcp -m state --state NEW -m multiport --dports 111,2049,32771,768,782 -j ACCEPT
iptables -A RH-Firewall-1-INPUT -s 192.168.0.0/255.255.255.0 -i eth0 -p udp -m state --state NEW -m multiport --dports 111,2049,32768,765,779 -j ACCEPT

You see that the multiport statement is just like the result of my rpcinfo command above.

Remember to save your new rules, othervise they will disappear the next time the iptables rules are being loaded.

In addition to this rule you should add the iptables rule for ssh access I wrote about earlier.

Another way to determine the ports

nmap -sC -p 111 localhost

Notice!
This solution won’t work after a reboot of the server since NFS changes ports. One way to overcome this problem is to follow the instructions in a newer post I’ve made about RedHat and NFS.