pf blocking nfs

[Aaron P. Martinez]

> Aaron P. Martinez wrote:
>> I am running FreeBSD 6.0-release and setting up a very basic firewall
>> using pf on my workstation.  The ruleset is as follows:
>>
>> block in log all
>> pass quick on lo0 all
>> #pass  in  on $ext_if proto tcp from any to $ext_if port 22 keep state
>> pass  out on fxp0 proto { tcp, udp, icmp } all keep state
>
> Your firewall config is not enough to permit NFS to pass.  You might
> consider adding a "pass all" rule for machines on the local subnet.
>
> [ Perhaps you should re-evaluate your network so that you do not attempt
> to pass NFS through the firewall.  If you have to do filesharing between
> machines over an untrusted connection, should should consider a VPN or
> SSH tunnel approach instead. ]
>
> --
> -Chuck

Actually my network looks like this:

INT---firewall------internal router/firewall---------good lan
        |                        |
        |                        |---------insecure lan (windoze machines)
        |
        |----DMZ

the good lan is the only one that does nfs, so the nfs doesn't actually
pass through the firewall, just connects to the internal router/firewall. 
I am simply trying to avoid a worst case scenario (internal router gets
compromised) so trying to allow ONLY return packets.  Is this unfeasable? 
Can you suggest a rule instead of:
pass  out on fxp0 proto { tcp, udp, icmp } all keep state

or in addition to that would still keep me very secure and at the same
time allow me to use nfs as i'm trying?

thanks for the quick reply,

Aaron Martinez