How to allow NFS server traffic through firewalld

NFS clients reach a Linux file server through firewall rules before export permissions or filesystem permissions are tested. On firewalld hosts, the important choice is whether the server only accepts NFSv4 or still supports NFSv3 clients, because older RPC services need their own exposure.

firewalld applies service and port rules inside zones. The server-facing interface might be in public, internal, or a custom zone, so add the NFS rules to that zone instead of assuming the default zone. Current service definitions open TCP 2049 for nfs, TCP and UDP 111 for rpc-bind, and TCP and UDP 20048 for mountd.

Use the NFSv4 path when /proc/fs/nfsd/versions shows NFSv3 disabled. If NFSv3 stays enabled, configure fixed lock and status ports before opening them, then test from an allowed client with the same server name and export path users will mount.

Steps to allow NFS server traffic through firewalld:

Check the firewalld zone that owns the server-facing interface.
```
$ sudo firewall-cmd --get-active-zones
public
  interfaces: enp1s0
```
Use the zone shown with the server-facing interface in the remaining commands. The examples use public.
Check the NFS versions exposed by the running server.
```
$ cat /proc/fs/nfsd/versions
+3 +4 -4.0 -4.1 +4.2
```
A plus sign before 3 means the server still accepts NFSv3 clients. A minus sign before 3 means the firewall can normally stay on the NFSv4 path with only the nfs service.

Related: How to configure an NFSv4-only server
Add the nfs service to the permanent zone.
```
$ sudo firewall-cmd --permanent --zone=public --add-service=nfs
success
```
The predefined nfs service opens TCP 2049. That is the normal server-side firewalld rule for NFSv4 mounts.
Add rpc-bind when the server still accepts NFSv3 clients.
```
$ sudo firewall-cmd --permanent --zone=public --add-service=rpc-bind
success
```
rpc-bind opens TCP and UDP 111 so older RPC-based clients can discover registered services.
Add mountd when NFSv3 export discovery must work.
```
$ sudo firewall-cmd --permanent --zone=public --add-service=mountd
success
```
mountd opens TCP and UDP 20048 in current firewalld service definitions. Some firewalld packages also include nfs3 for TCP and UDP 2049, but it does not replace rpc-bind, mountd, or fixed lock and status ports.
Configure or confirm fixed NFSv3 lock and status ports before opening them.
```
[lockd]
port=5555
 
[statd]
port=6666
```
Do not open arbitrary high RPC ports for NFSv3 traffic. Use site-approved fixed ports in /etc/nfs.conf and open only those ports in firewalld.

Related: How to configure fixed NFSv3 ports for firewall rules
Add the fixed NFSv3 lock and status ports to the permanent zone.
```
$ sudo firewall-cmd --permanent --zone=public --add-port=5555/tcp --add-port=5555/udp --add-port=6666/tcp --add-port=6666/udp
success
```
Skip this step on a strict NFSv4 server, or replace the example port numbers with the fixed lockd and statd values already active on the server.
Reload firewalld to apply the permanent rules.
```
$ sudo firewall-cmd --reload
success
```
Restart NFS services if fixed NFSv3 ports changed.
```
$ sudo systemctl restart rpc-statd nfs-server
```
Skip this restart when the fixed NFSv3 ports were already active and only firewalld rules changed.
Verify the allowed firewalld services.
```
$ sudo firewall-cmd --zone=public --list-services
dhcpv6-client mountd nfs rpc-bind ssh
```
A strict NFSv4 server should show nfs, but it does not need mountd or rpc-bind for client mounts.

Verify the fixed NFSv3 ports when they were added.

$ sudo firewall-cmd --zone=public --list-ports
5555/tcp 6666/tcp 5555/udp 6666/udp

From an allowed client, list exports when NFSv3 or mixed-version visibility is expected.
```
$ showmount --exports files.example.net
Export list for files.example.net:
/srv/nfs/projects 192.0.2.0/24
```
A strict NFSv4 server may not answer showmount because that command uses the older mount protocol path. Test the known NFSv4 export path directly instead.

Related: How to list NFS exports from a client
Mount the export from an allowed client.
```
$ sudo mount -t nfs4 files.example.net:/srv/nfs/projects /mnt/projects
```
Use nfs with a version option such as vers=3 only when the server intentionally supports NFSv3 clients.

Related: How to mount an NFS export on Linux

Verify the mounted source on the client.

$ findmnt -o TARGET,SOURCE,FSTYPE /mnt/projects
TARGET        SOURCE                               FSTYPE
/mnt/projects files.example.net:/srv/nfs/projects nfs4

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.