When I disable the server firewall, the exported directories appear on the NFS client. Otherwise they don't.
I've tried allowing the 'nfs' service on both the "public" and "internal" zones of the wired interface's firewall (where 'ssh' is explicitly allowed and gets through the hole), to no avail. I'm out of ideas.
edit: When I stop the server firewall and mount an exported directory, I see the following output on the server:
$ ss -o state established '( dport = :nfs or sport = :nfs )'
Netid Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp 0 0 192.168.1.66:nfs 192.168.1.68:vacdsm-app
edit: Complicating the picture is the fact that the port(s) required in order for the client to receive a list of the directories exported on the server is different from those needed to actually view the contents of those directories. So one might be able to simply turn off the firewall, configure the client using the list of exported directories and then turn the firewall back on to find that they're available on the client... What a mess.