Fail to mount during image deployment

[WT_101]

We encounter this error while trying to perform image deployment over different subnet (FOG Server at subnet A, client at subnet B) & firewall with below ports whitelisted:
80/tcp
443/tcp
69/udp
1024-65535/udp
111/udp and 111/tcp
2049/udp and 2049/tcp

We tried to manually mount from the system and it failed as well

We do try to telnet 2049 ports it can connect successful

Is there any ports/configuration need to be done in order for it to work?

[george1421]

@wt_101 Here is a post that talks about firewall configuration
https://forums.fogproject.org/topic/6162/firewall-configuration

The issue is nfsv3 needs a wide port range to communicate correctly. Potentially switching over to NFSv4 will help eliminate this large firewall range requirement. FOG is not there yet but its on the roadmap.

[WT_101]

Hi @george1421

We have read up the post you share but we never turn on firewall at FOG server. So we not quite sure how the firewall configuration able to resolved the issue we encounter.

Let me explain in detail to you on our setup. We have 2 Site: Site A and Site B

Site A

• FOG Server installed at Site A (192.168.10.1)
• It having multiple subnet e.g 192.168.10.0 & 192.168.20.0
• We tested client system at site A for both subnet192.168.10.0 & 192.168.20.0 able to perform image capture & deployment smoothly

Site B

• client system at subnet (175.168.10.0)
• client system (175.168.10.20) able to perform PXE boot getting FOG NBP file though the FOG Server at site A (192.168.10.1)
• client system (175.168.10.20) also able to detect the tasks(capture, deploy, debug) created from site A FOG Server

Previously client system (175.168.10.20) at Site B not even able to PXE boot to site A FOG Server (192.168.10.1) until we ask our IT team to whitelist the below port BI Direction between Site A & Site B.
80/tcp
443/tcp
69/udp
1024-65535/udp
111/udp and 111/tcp
2049/udp and 2049/tcp

Now client system (175.168.10.20) at Site B Fail at “Mounting File System”

Can you advise is there any other ports need to be open to resolve this issue? Or any method we can troubleshoot on why we facing this issue?

We do refer to below site found that the port highlight in yellow is not open. Will these causing the mounting fail?

https://wiki.fogproject.org/wiki/index.php/FOGUserGuide#Full_Listing_of_Ports_used_by_FOG_server_and_client

Please do let me know if anything is unclear

Thank You

[Sebastian Roth]

@wt_101 said in Fail to mount during image deployment:

1024-65535/udp

I think the issue is here. NFS used TCP high ports. So you’d need to ask for 1024-65535/tcp as well. Though obviously this would render a firewall more or less useless.

If you can’t open the firewall then you might get involved in FOG development and help adding NFSv4 or other solutions like sshfs more quickly.

[george1421]

@wt_101 said in Fail to mount during image deployment:

We have read up the post you share but we never turn on firewall at FOG server

Previously client system (175.168.10.20) at Site B not even able to PXE boot to site A FOG Server (192.168.10.1) until we ask our IT team to whitelist the below port BI Direction between Site A & Site B.

The context was these are the ports that need to be open [on the fog server] so that you can apply the same rules to your network.

If you look at the iptables entry in the url I referenced.

echo "IPTABLES_MODULES=\"nf_conntract_tftp nf_conntrack_ftp nf_conntrack_netbios_ns\"" >> /etc/sysconfig/iptables-config
for port in 80 443 21 3306 2049 20048 111 138 139 445; do iptables -I INPUT 1 -p tcp --dport $port -j ACCEPT; done
for port in 69 111 4011 137; do iptables -I INPUT 1 -p udp --dport $port -j ACCEPT; done
service iptables save

It says you need to open these tcp ports {80 443 21 3306 2049 20048 111 138 139 445}

And you need to open these udp ports {69 111 4011 137}

FOG NFSv3 does use tcp for its data channels and not udp.

[WT_101]

Hi @george1421

The mount is working due to the high port 1024-65535 is not open causing the mount fail.

Just to understand on NFSv4. We tested with debug task on the current FOS are able perform mount using NFSv4.

Is there any concern on changing the FOS mounting with NFSv4?

[george1421]

@wt_101 I do have a proof of concept for NFSv4 and I’m running it on one of my production FOG servers. https://forums.fogproject.org/topic/14791/feature-request-for-fog-1-6-x-configure-image-capture-to-use-nfsv4-instead-of-nfsv3/10

The tough spot is that you need different inits with NFSv4 enabled. The default inits that come with FOG have nfsv4 disabled. The other issue with nfsv4 is that the shares are changed a bit into a virtual share. My PoC thread also covers that. I really need to consolidate that into an easy to follow thread. I was going to save pushing for nfsv4 in FOG 1.6.x series but that series is getting pushed out because of the lack of dev time. Here are the inits from Jun 2021 with nfsv4 enabled: https://drive.google.com/file/d/1EHLhmM9-kXpFO7kfk3H1ydEZF3q8lID1/view?usp=sharing