The NFS server relies on RPC to route connections between nfs server(s) and client(s). According to the
-H or --host hostname
specify a particular hostname (or address) that NFS requests will be accepted on. By default, rpc.nfsd will accept NFS requests on all known network addresses.
Note that lockd (which performs file locking services for NFS) may still accept request on all known network addresses. This may change in future releases of
the Linux Kernel. This option can be used multiple time to listen to more than one interface.
Therefore, you can configure the restriction, to some extent, on the NFS server's side by adding the hostname assigned to the IP/NIC into the
/etc/nfs.conf configuration file.
127.0.0.1 localhost.localdomain localhost
# Public network interface
# Local network interface
Then, add the hostname of the "Local network interface" to the
nfsd section of the NFS configuration file
That way, the
rpcbind daemon listens to that interface only, ignoring the public network interface.
Additionally, set the correct parameters within the
/etc/exports configuration file, indicating only the local network/subdomain allowed to mount the Network File Shares.
Configure your Firewall accordingly
Separate your Network Interface Cards (NIC) into different zones, for example. Or, if using
iptables, make the appropriate ports open only on the specific network or subdomain.