# $Header: /global/src/etc/cl-manage-scripts/patches/RCS/P-iptables-virtual-udp-nfs-servers,v 1.6 2008/03/06 07:12:34 pb22 Exp $
# patch to allow UDP replies from virtual NFS servers
# patch-file matches : 2049.-s.128.232.1.212
# patch-file distmatches = Fedora.Core.release.[56]|Fedora.release.[78]
# Process using /usr/bin/cl-patch-file unless matching the above
--- /etc/sysconfig/iptables	2006-08-29 15:02:55.000000000 +0100
+++ /etc/sysconfig/iptables	2006-09-18 06:45:16.000000000 +0100
@@ -14,2 +14,5 @@
 -A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
+#2 cl.cam.ac.uk: Allow UDP NFS from servers which reply from the wrong address (so not ESTABLISHED)
+-A RH-Firewall-1-INPUT -p udp -m udp --sport 2049 -s 128.232.1.212 -j ACCEPT
+-A RH-Firewall-1-INPUT -p udp -m udp --sport 2049 -s 128.232.104.33 -j ACCEPT
 -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
