Configure firewall rules

This page explains when you must configure firewall rules to enable NFS file locking.

Conditions that require firewall ingress rule configuration

You must create a firewall ingress rule to enable traffic from Filestore instances to your clients if:

  • You are using NFS file locking in the applications accessing the Filestore instance.

  • The VPC network you are using has firewall rules that block TCP port 111 or the ports used by the statd or nlockmgr daemons. To determine what ports the statd and nlockmgr daemons use on the client, check current port settings.

    If the statd and nlockmgr ports aren't set, and you think you might need to configure firewall rules at any point, we strongly recommend setting those ports consistently on all client VM instances. For more information, see Setting NFS ports.

Conditions that require firewall egress rule configuration

You must create a firewall egress rule to enable traffic from your clients to your Filestore instances if:

  • The VPC network you're using has a firewall egress rule for the IP address ranges used by your Filestore instances.
  • The firewall egress rule blocks traffic to TCP ports 111, 2046, 2049, 2050, or 4045.

You can get the reserved IP address range for any Filestore instance from the Filestore instances page or by running gcloud filestore instances describe. For more information, see Get information about a specific instance.

For more information about VPC network firewall rules, see Using Firewall Rules.

Create a firewall ingress rule

Use the following procedure to create a firewall rule to enable traffic from Filestore instances.

  1. Before you begin, verify the following:

    Windows

    1. Confirm that the client is allowed to communicate with the Filestore instance and that the local firewall is not blocking the required ports. To open all required NFS ports, run the following command in PowerShell:

         '111','2046','2049','2050','4045' | % {
      C:\Windows\system32\netsh.exe advfirewall firewall add rule name="NFS Shares allow TCP/UDP port $($_)" dir=IN action=ALLOW protocol=TCP,UDP localport=$($_)
   }

    2. Check current port settings to determine what ports the statd and nlockmgr daemons use on the client. Make note of them for later use.

    Linux

    No prerequisites for completing this task.

    MacOS

    No prerequisites for completing this task.

  2. Go to the Firewall page in the Google Cloud console.
    Go to the Firewall page

  3. Click Create firewall rule.