0

I'm trying to access a NFS share. The NFS share is in a server I have at home, and I'm trying to access to it from outside my local network.

In order to achieve this, I have started an OpenVPN server on my local network. This works fine and I can connect to the VPN from outside the local network and I can even ping the server and access some other services that are local only. My OpenVPN IP address is 172.27.232.5.

The problem is that I can't mount my NFS share. When I connect to the VPN, I can see the shares using showmount command

showmount -e 192.168.73.2
Export list for 192.168.73.2:
/media/share/kdab     192.168.73.0/24
/media/share/jjcasmar 192.168.73.0/24

but if I try to connect to any of them, it fails.

sudo mount -t nfs4 192.168.73.2:/media/share/jjcasmar /home/jjcasmar/mnt
mount.nfs4: access denied by server while mounting 192.168.73.2:/media/share/jjcasmar

I don't understand what is wrong with my setup, and Im not very good and networks. Any ideas of what might be happening?

The result of ip addr show for the VPN connection is

13: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
    link/none 
    inet 172.27.232.5/23 brd 172.27.233.255 scope global tun1
       valid_lft forever preferred_lft forever
    inet6` fe80::b6a9:fff6:dd69:6f7f/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

If I understand correctly, the NFS server denies the connection because althought I can see the server on 192.168.73.2, I'm not on that subnet, right?

I have tried to modify the exports to add 172.27.232.0/23, but it's still failing. I have also tried to export directly to my OpenVPN IP, 172.27.232.5 without success.

  • 2
    welcome to U&L, can you add to your post result of ip a s when VPN is connected ? – Archemar May 31 at 10:54
0

OpenVPN typically uses a routed network to connect clients to the server. So for example, although your LAN is 192.168.73.0/24 your connected client might be assigned the VPN address 10.0.0.2. Routing allows your client to reach devices on your LAN.

Running ip addr (ip a) on your client while the VPN is connected will show the subnet being used for OpenVPN - or you can look in the OpenVPN server configuration file (typically under /etc/openvpn on the server).

Looking at showmount you can see that the NFS exports are being offered only to hosts on your LAN, 192.168.73.0/24.

Your client isn't on 192.168.73.0/24 so it is denied permission. The solution is to modify /etc/exports on your server to include access to the OpenVPN subnet.

With NFS v3 I'd do something like this, but I don't know how much is still required for NFS v4:

/media/share/kdab     192.168.73.0/24 172.27.232.0/23
/media/share/jjcasmar 192.168.73.0/24 172.27.232.0/23

Again, for NFS v3 I'd then run exportfs -var but I don't know if that's still required (I've never got on with NFS v4 - too much complexity for no obvious gain).

  • Thanks for this explanation. I thought about something like that, and I also tried to export to the openvpn subnet. The vpn ip is 172.27.232.5, and I tried to export to 172.27.232.0/24, but also failed – jjcasmar May 31 at 11:27
  • @jjcasmar your VPN is 23 bit not 24, try to add 172.27.232.0/23 – Archemar May 31 at 11:46
  • @Archemar thanks. Example fixed. – roaima May 31 at 11:51
  • Thanks. Ill try this when Im back home, as I cant ssh the server from outside. I dont understand why is 23 instead of 24. Where can I read about it? – jjcasmar May 31 at 11:53
  • man openvpn on your client or server, and then look at the configuration typically under /etc/openvpn. – roaima May 31 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.