On a CentOS7 client, running mount as root (in all cases), if I use this iptables rule-

-A OUTPUT -i eth0 -p tcp --dport 2049 -m state --state NEW,ESTABLISHED -j ACCEPT

...the NFS4 mount goes through fine.

But if I limit the rule to the root user-

-A OUTPUT -i eth0 -p tcp --dport 2049 -m owner --uid-owner root -m state --state NEW,ESTABLISHED -j ACCEPT

...iptables blocks the mount. In /var/log/messages I see-

Dec 7 14:00:29 nfsclient kernel: IPtables DROP DEFAULT OUT: IN= OUT=eth0 SRC=<client IP> DST=<server IP> LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=63737 DF PROTO=TCP SPT=987 DPT=2049 WINDOW=26883 RES=0x00 SYN URGP=0

...which begs the question, "who mounts the NFS share?" or "why does IPtables block when the root user is specified?"

1 Answer 1


From iptables -m owner --help:

owner match options:
[!] --uid-owner userid[-userid]      Match local UID

You need to specify a UID, not a username. So instead, try:

-A OUTPUT -i eth0 -p tcp --dport 2049 -m owner --uid-owner 0 -m state --state NEW,ESTABLISHED -j ACCEPT
  • Oh!! I cannot believe I missed that- thank you.
    – hotkarl
    Commented Dec 7, 2016 at 20:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .