22

I haven't found a slam-dunk document on this, so let's start one.

On a CentOS 7.1 host, I have gone through the linuxconfig HOW-TO, including the firewall-cmd entries, and I have an exportable filesystem.

[root@<server> ~]# firewall-cmd --list-all
internal (default, active)
  interfaces: enp5s0
  sources: 192.168.10.0/24
  services: dhcpv6-client ipp-client mdns ssh
  ports: 2049/tcp
  masquerade: no
  forward-ports: 
  rich rules: 

[root@<server> ~]# showmount -e localhost
Export list for localhost:
/export/home/<user> *.localdomain

However, if I showmount from the client, I still have a problem.

[root@<client> ~]# showmount -e <server>.localdomain
clnt_create: RPC: Port mapper failure - Unable to receive: errno 113 (No route to host)

Now, how am I sure that this is a firewall problem? Easy. Turn off the firewall. Server side:

[root@<server> ~]# systemctl stop firewalld

And client side:

[root@<client> ~]# showmount -e <server>.localdomain
Export list for <server>.localdomain:
/export/home/<server> *.localdomain

Restart firewalld. Server side:

[root@<server> ~]# systemctl start firewalld

And client side:

[root@<client> ~]# showmount -e <server>.localdomain
clnt_create: RPC: Port mapper failure - Unable to receive: errno 113 (No route to host)

So, let's go to town, by adapting the iptables commands from a RHEL 6 NFS server HOW-TO...

[root@ ~]# firewall-cmd \
>  --add-port=111/tcp \
>  --add-port=111/udp \
>  --add-port=892/tcp \
>  --add-port=892/udp \
>  --add-port=875/tcp \
>  --add-port=875/udp \
>  --add-port=662/tcp \
>  --add-port=662/udp \
>  --add-port=32769/udp \
>  --add-port=32803/tcp
success

[root@<server> ~]# firewall-cmd \
>  --add-port=111/tcp \
>  --add-port=111/udp \
>  --add-port=892/tcp \
>  --add-port=892/udp \
>  --add-port=875/tcp \
>  --add-port=875/udp \
>  --add-port=662/tcp \
>  --add-port=662/udp \
>  --add-port=32769/udp \
>  --add-port=32803/tcp \
>  --permanent
success

[root@<server> ~]# firewall-cmd --list-all
internal (default, active)
  interfaces: enp5s0
  sources: 192.168.0.0/24
  services: dhcpv6-client ipp-client mdns ssh
  ports: 32803/tcp 662/udp 662/tcp 111/udp 875/udp 32769/udp 875/tcp 892/udp 2049/tcp 892/tcp 111/tcp
  masquerade: no
  forward-ports: 
  rich rules: 

This time, I get a slightly different error message from the client:

[root@<client> ~]# showmount -e <server>.localdomain
rpc mount export: RPC: Unable to receive; errno = No route to host

So, I know I'm on the right track. Having said that, why can't I find a definitive tutorial on this anywhere? I can't have been the first person to have to figure this out!

What firewall-cmd entries am I missing?

Oh, one other note. My /etc/sysconfig/nfs files on the CentOS 6 client and the CentOS 7 server are unmodified, so far. I would prefer to not have to change (and maintain!) them, if at all possible.

4 Answers 4

53

This should be enough:

firewall-cmd --permanent --add-service=nfs
firewall-cmd --permanent --add-service=mountd
firewall-cmd --permanent --add-service=rpc-bind
firewall-cmd --reload
4
  • Not enough in my case. I've got two NFS servers, the first one broadcasts correctly and is subscribed by its clients, the second is apparently broadcasting all right but its client (the first server) is unable to 'showmount' (rpc mount export: RPC: Unable to receive; errno = No route to host). I'll comeback here if/when I solve this.
    – Urhixidur
    Commented Jul 14, 2016 at 14:21
  • 1
    Turns out the SERVER needed the three services (nfs, mountd, rpc-bind) added to its firewall (dunno if the client needs all three too; it just happens to have all three in my case). In my case, the client (first NFS server) had it but the server (second NFS server) was missing mountd.
    – Urhixidur
    Commented Jul 14, 2016 at 14:32
  • @Urhixidur the client should not need these because firewalld allows outgoing connections.
    – T0xicCode
    Commented Jan 23, 2017 at 17:57
  • Note the spelling of rpc-bind. Although I enabled it with systemctl enable rpcbind and systemctl start rpcbind, firewall-cmd told me Error: INVALID_SERVICE: rpcbind. Soon I realized that it needs a dash in this context! Are they really the same service?
    – Qwertie
    Commented Jan 17, 2019 at 0:01
8

After configuring NFS server we should enable and start three services:

  1. nfs-server.service
  2. rpcbind.service
  3. nfs-mountd.service (only start is needed)

And also allow these services on server firewall:

# firewall-cmd --permanent --add-service=nfs
# firewall-cmd --permanent --add-service=rpcbind
# firewall-cmd --permanent --add-service=mountd
# firewall-cmd --reload
1
  • Should be rpc-bind.
    – bolind
    Commented Nov 3, 2021 at 9:43
4

Just found this - and it works when the problem is SELinux blocking the reading of the ~/.ssh/authorized_keys during login! First, enxure your ~/.ssh/authorized_keys file is properly populated and its permissions and its folder's permissions are set correctly. If you then run "setenforce 0" on the SSH destination host and are able to login to that host without entering a password, but cannot do so after entering "setenforce 1" on that same destination host, the following may fix your issue:

setsebool -P use_nfs_home_dirs 1

ref: https://cassjohnston.wordpress.com/2015/06/12/selinux-nfs-home-directories/

1

I use nfsv4 and works fine with those lines, supposing your zone is "public" and you are using the default ports 2049 and 4001

firewall-cmd --permanent --add-service=nfs --zone=public
firewall-cmd --permanent --add-service=mountd --zone=public
firewall-cmd --permanent --add-service=rpc-bind --zone=public
firewall-cmd --permanent --add-port=4001/udp --zone=public
firewall-cmd --permanent --add-port=4001/tcp --zone=public
firewall-cmd --permanent --add-port=2049/tcp --zone=public
firewall-cmd --permanent --add-port=2049/udp --zone=public
firewall-cmd --reload

I forgot one important thing: is useful to set a static port for mountd, so you can use showmount -e to see the shares. Personally I use 34777

root      1873     1  0 21:11 ?        00:00:00 /usr/sbin/rpc.mountd -p 34777

So you will open port on firewall

  firewall-cmd --permanent --add-port=34777/udp --zone=public
  firewall-cmd --permanent --add-port=34777/tcp --zone=public

The configuration of mount port is different from distro, some uses /etc/sysconfig some other use /etc/default, some other require to edit scripts..check the docs for your distro.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .