<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hello List,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am working on a small project where I need to encrypt nfs traffic, and Stunnel looks to be ideal, the only issue I’m having is getting the transparent part to work<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have a client machine, running stunnel config below<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">#GLOBAL#######################################################<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">sslVersion = TLSv1.2<o:p></o:p></p>
<p class="MsoNormal">TIMEOUTidle = 600<o:p></o:p></p>
<p class="MsoNormal">renegotiation = no<o:p></o:p></p>
<p class="MsoNormal"> FIPS = no<o:p></o:p></p>
<p class="MsoNormal"> options = NO_SSLv2<o:p></o:p></p>
<p class="MsoNormal"> options = NO_SSLv3<o:p></o:p></p>
<p class="MsoNormal"> options = SINGLE_DH_USE<o:p></o:p></p>
<p class="MsoNormal"> options = SINGLE_ECDH_USE<o:p></o:p></p>
<p class="MsoNormal"> options = CIPHER_SERVER_PREFERENCE<o:p></o:p></p>
<p class="MsoNormal"> syslog = yes<o:p></o:p></p>
<p class="MsoNormal"> debug = 7<o:p></o:p></p>
<p class="MsoNormal"> ;chroot = /var/empty/stunnel<o:p></o:p></p>
<p class="MsoNormal"> libwrap = yes<o:p></o:p></p>
<p class="MsoNormal"> service = 3d-nfsd<o:p></o:p></p>
<p class="MsoNormal"> curve = secp521r1<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">#CREDENTIALS##################################################<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> verify = 4<o:p></o:p></p>
<p class="MsoNormal"> CAfile = /etc/stunnel/nfs-tls.pem<o:p></o:p></p>
<p class="MsoNormal"> cert = /etc/stunnel/nfs-tls.pem<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">#ROLE#########################################################<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> client = yes<o:p></o:p></p>
<p class="MsoNormal"> connect = fqdn:2363<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">and the client which is running ontop of the nfs-ganesha server config below<o:p></o:p></p>
<p class="MsoNormal">#GLOBAL#######################################################<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">TIMEOUTidle = 600<o:p></o:p></p>
<p class="MsoNormal">renegotiation = no<o:p></o:p></p>
<p class="MsoNormal"> FIPS = no<o:p></o:p></p>
<p class="MsoNormal"> options = NO_SSLv2<o:p></o:p></p>
<p class="MsoNormal"> options = NO_SSLv3<o:p></o:p></p>
<p class="MsoNormal"> options = SINGLE_DH_USE<o:p></o:p></p>
<p class="MsoNormal"> options = SINGLE_ECDH_USE<o:p></o:p></p>
<p class="MsoNormal"> options = CIPHER_SERVER_PREFERENCE<o:p></o:p></p>
<p class="MsoNormal"> syslog = yes<o:p></o:p></p>
<p class="MsoNormal"> debug = 7<o:p></o:p></p>
<p class="MsoNormal"> setuid = nobody<o:p></o:p></p>
<p class="MsoNormal"> setgid = nobody<o:p></o:p></p>
<p class="MsoNormal"> chroot = /var/empty/stunnel<o:p></o:p></p>
<p class="MsoNormal"> libwrap = yes<o:p></o:p></p>
<p class="MsoNormal"> service = MC-nfsd<o:p></o:p></p>
<p class="MsoNormal"> ; cd /var/empty; mkdir -p stunnel/etc; cd stunnel/etc;<o:p></o:p></p>
<p class="MsoNormal"> ; echo 'MC-nfsd: ALL EXCEPT 5.6.7.8' >> hosts.deny;<o:p></o:p></p>
<p class="MsoNormal"> ; chcon -t stunnel_etc_t hosts.deny<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> curve = secp521r1<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">#CREDENTIALS##################################################<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> verify = 4<o:p></o:p></p>
<p class="MsoNormal"> CAfile = /etc/stunnel/nfs-tls.pem<o:p></o:p></p>
<p class="MsoNormal"> cert = /etc/stunnel/nfs-tls.pem<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">#ROLE#########################################################<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> connect = 127.0.0.1:2049<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have had a look through the documentation and I believe I need to set transparent = source on the client side, and then set some ip tables firewall rules. Does anyone have a guide, or some advice on how to get this to work. Generally
what happens if I set the firewall rules, on the client, and set the transparent to source I just get connection closed by remote host. I never actually see the traffic leave the client host.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">To confirm, when not using transparent everything works correctly, accept the server side sees the connection coming from 127.0.0.1<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">Rgds<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">Steve.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
<div style="mso-element:para-border-div;border-top:solid windowtext 1.0pt;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:none;padding:1.0pt 0cm 1.0pt 0cm">
<p class="MsoNormal" style="line-height:150%;border:none;padding:0cm"><span style="font-family:"Arial",sans-serif;color:black;mso-fareast-language:EN-GB">The future has already arrived. It's just not evenly distributed yet - William Gibson<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div style="mso-line-height-rule:exactly;-webkit-text-size-adjust:100%;"><table cellpadding="0" cellspacing="0" border="0" style="width:100%;"><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:15px 0 0;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="height:0;font-size:0;color:#7C7C7B;font-style:normal;font-weight:700;white-space:nowrap;"><tr style="font-size:12px;"><td align="left" style="vertical-align:top;font-family:Arial;">Steven Relf<span style="font-family:remialcxesans;font-size:1px;color:#FFFFFF;line-height:1px;"></span></td><td align="left" style="vertical-align:top;font-size:0;"><table cellpadding="0" cellspacing="0" border="0" style="white-space:nowrap;color:#7C7C7B;font-size:16px;font-family:Arial;font-weight:700;font-style:normal;text-align:left;line-height:13.33px;"><tr style="font-size:16px;"><td style="font-family:Arial;"> ‑ <br /></td></tr></table></td><td align="left" style="vertical-align:top;font-family:Arial;">Technical Authority: Cloud Native Infrastructure</td></tr></table></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:10px 0 0;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:12px;color:#7C7C7B;font-style:normal;font-weight:700;white-space:nowrap;"><td align="left" style="vertical-align:top;font-family:Arial;"><a href="mailto:srelf@ukcloud.com" target="_blank" id="LPlnk689713" style="text-decoration:none;color:#7C7C7B;"><strong style="font-weight:700;">srelf@ukcloud.com</strong></a></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="width:100%;font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:5px 0 0;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="width:100%;font-size:0;color:#7C7C7B;font-style:normal;font-weight:700;white-space:nowrap;"><tr style="font-size:12px;"><td align="left" style="vertical-align:top;font-family:Arial;"><a href="tel:+44%201252%20936019" target="_blank" id="LPlnk689713" style="text-decoration:none;color:#7C7C7B;"><strong style="font-weight:700;">+44 1252 936019</strong></a></td><td align="left" style="vertical-align:top;font-family:Arial;"> / </td><td align="left" style="vertical-align:top;font-family:Arial;font-weight:400;"><a href="tel:+44%207500%20085%20864" target="_blank" id="LPlnk689713" style="text-decoration:none;color:#7C7C7B;"><strong style="font-weight:700;">+44 7500 085 864</strong></a></td></tr></table></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#7C7C7B;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:12px;"><td align="left" style="padding:5px 0 0;vertical-align:top;font-family:Arial;"><a href="http://www.ukcloud.com/" target="_blank" id="LPlnk689713" style="text-decoration:none;color:#7C7C7B;"><strong style="font-weight:700;">www.ukcloud.com</strong></a></td></tr></table></td></tr></table></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;line-height:normal;"><tr style="font-size:0;"><td align="left" style="padding:5px 0;vertical-align:top;"><a href="http://www.ukcloud.com/" target="_blank" id="LPlnk689713" style="text-decoration:none;"><img src="cid:image047554.png@3DC71287.64F0E8E7" width="270" height="61" border="0" alt="" style="width:270px;min-width:270px;max-width:270px;height:61px;min-height:61px;max-height:61px;font-size:0;" /></a></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#7C7C7B;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:12px;"><td align="left" style="vertical-align:top;font-family:Arial;">A8, Cody Technology Park, Ively Road</td><td align="left" style="vertical-align:top;font-family:Arial;">, </td><td align="left" style="vertical-align:top;font-family:Arial;white-space:normal;">Farnborough</td><td align="left" style="vertical-align:top;font-family:Arial;">, </td><td align="left" style="vertical-align:top;font-family:Arial;">GU14 0LX</td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:13px 0;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;line-height:normal;"><tr style="font-size:0;"><td align="left" style="padding:0 5px 0 0;vertical-align:top;"><a href="https://twitter.com/ukcloudltd" target="_blank" id="LPlnk689713" style="text-decoration:none;"><img src="cid:image361467.png@E83BF03E.6FBBEE26" width="27" height="27" border="0" alt="" style="width:27px;min-width:27px;max-width:27px;height:27px;min-height:27px;max-height:27px;font-size:0;" /></a></td></tr></table></td><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;line-height:normal;"><tr style="font-size:0;"><td align="left" style="padding:0 5px 0 0;vertical-align:top;"><a href="https://www.linkedin.com/company/ukcloud-ltd" target="_blank" id="LPlnk689713" style="text-decoration:none;"><img src="cid:image659367.png@6729D5B9.063FF01B" width="27" height="27" border="0" alt="" style="width:27px;min-width:27px;max-width:27px;height:27px;min-height:27px;max-height:27px;font-size:0;" /></a></td></tr></table></td><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;line-height:normal;"><tr style="font-size:0;"><td align="left" style="padding:0 5px 0 0;vertical-align:top;"><a href="https://www.youtube.com/channel/UCnlFUyOWcS4iE_HK-ZEcNGw" target="_blank" id="LPlnk689713" style="text-decoration:none;"><img src="cid:image618123.png@949653CD.9CF7FED3" width="27" height="27" border="0" alt="" style="width:27px;min-width:27px;max-width:27px;height:27px;min-height:27px;max-height:27px;font-size:0;" /></a></td></tr></table></td></tr></table></td></tr></table></td></tr></table></td></tr><tr style="font-size:0;line-height:normal;"><td align="left" style="vertical-align:top;"><a href="https://ukcloud.com/ccs-mou/" target="_blank" id="LPlnk689713" style="text-decoration:none;"><img src="cid:image016495.png@330465DE.108985DC" width="400" height="130" border="0" title="UKCloud recognised by Crown Commercial Services as a strategic provider of multi-cloud" alt="UKCloud recognised by Crown Commercial Services as a strategic provider of multi-cloud" style="width:400px;min-width:400px;max-width:400px;height:130px;min-height:130px;max-height:130px;font-size:12px;" /></a></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:50px 0 0;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="white-space:normal;color:#000001;font-size:16px;font-family:Arial;font-weight:400;font-style:normal;text-align:justify;width:700px;"><tr style="font-size:10px;"><td style="font-family:Calibri;"><span style="background-color:#FFFFFF;">Notice: This message contains information that may be privileged or confidential and is the property of UKCloud Ltd. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorised to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message. UKCloud reserves the right to monitor all e-mail communications through its networks. UKCloud Ltd is registered in England and Wales: Company No: 07619797. Registered office: Hartham Park, Hartham, Corsham, Wiltshire SN13 0RP.</span><br /></td></tr></table></td></tr></table></td></tr></table></div></body>
</html>