Access denied on NFS over OpenVPN

Question

I'm trying to access a NFS share. The NFS share is in a server I have at home, and I'm trying to access to it from outside my local network.

In order to achieve this, I have started an OpenVPN server on my local network. This works fine and I can connect to the VPN from outside the local network and I can even ping the server and access some other services that are local only. My OpenVPN IP address is 172.27.232.5.

The problem is that I can't mount my NFS share. When I connect to the VPN, I can see the shares using showmount command

showmount -e 192.168.73.2
Export list for 192.168.73.2:
/media/share/kdab     192.168.73.0/24
/media/share/jjcasmar 192.168.73.0/24

but if I try to connect to any of them, it fails.

sudo mount -t nfs4 192.168.73.2:/media/share/jjcasmar /home/jjcasmar/mnt
mount.nfs4: access denied by server while mounting 192.168.73.2:/media/share/jjcasmar

I don't understand what is wrong with my setup, and Im not very good and networks. Any ideas of what might be happening?

The result of ip addr show for the VPN connection is

13: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
    link/none 
    inet 172.27.232.5/23 brd 172.27.233.255 scope global tun1
       valid_lft forever preferred_lft forever
    inet6` fe80::b6a9:fff6:dd69:6f7f/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

If I understand correctly, the NFS server denies the connection because althought I can see the server on 192.168.73.2, I'm not on that subnet, right?

I have tried to modify the exports to add 172.27.232.0/23, but it's still failing. I have also tried to export directly to my OpenVPN IP, 172.27.232.5 without success.

Answer 1

OpenVPN typically uses a routed network to connect clients to the server. So for example, although your LAN is 192.168.73.0/24 your connected client might be assigned the VPN address 10.0.0.2. Routing allows your client to reach devices on your LAN.

Running ip addr (ip a) on your client while the VPN is connected will show the subnet being used for OpenVPN - or you can look in the OpenVPN server configuration file (typically under /etc/openvpn on the server).

Looking at showmount you can see that the NFS exports are being offered only to hosts on your LAN, 192.168.73.0/24.

Your client isn't on 192.168.73.0/24 so it is denied permission. The solution is to modify /etc/exports on your server to include access to the OpenVPN subnet.

With NFS v3 I'd do something like this, but I don't know how much is still required for NFS v4:

/media/share/kdab     192.168.73.0/24 172.27.232.0/23
/media/share/jjcasmar 192.168.73.0/24 172.27.232.0/23

Again, for NFS v3 I'd then run exportfs -var but I don't know if that's still required (I've never got on with NFS v4 - too much complexity for no obvious gain).