When I disable the server firewall, the exported directories appear on the NFS client. Otherwise they don't.

I've tried allowing the 'nfs' service on both the "public" and "internal" zones of the wired interface's firewall (where 'ssh' is explicitly allowed and gets through the hole), to no avail. I'm out of ideas.

edit: When I stop the server firewall and mount an exported directory, I see the following output on the server:

$ ss -o state established '( dport = :nfs or sport = :nfs )'
Netid     Recv-Q     Send-Q          Local Address:Port           Peer Address:Port           
tcp       0          0        

edit: Complicating the picture is the fact that the port(s) required in order for the client to receive a list of the directories exported on the server is different from those needed to actually view the contents of those directories. So one might be able to simply turn off the firewall, configure the client using the list of exported directories and then turn the firewall back on to find that they're available on the client... What a mess.

  • See what the nfs service permits, and then compare that to the output of ss or netstat for the related nfs process(es)
    – cutrightjm
    Sep 1, 2020 at 3:59
  • Interesting. So maybe the firewall thinks 'nfs' should run on different port(s) than it's actually running on? Sep 2, 2020 at 20:56
  • That's a possibility. I would think that it shouldn't be the case, but may be. I'm not sure about OpenSuse, but in CentOS if you add a firewall rule and don't use --permanent it will remove the rule if you restart the firewall. I've seen a few people add a rule, restart the firewall, then get stumped when the rule isn't there in the future.. doesn't sound like you've had that issue though
    – cutrightjm
    Sep 3, 2020 at 1:45

2 Answers 2


Listing the results from ss provided the clue I needed to get NFS working on my network. The local service is listed as nfs but the peer's service is vacdsm-app. Looking through the list of services on the server, I noticed vacdsm listed. Adding it to the list of allowed services on the firewall allows an exported directory to be mounted on the client system.

There still seems to be a problem on the client listing the exported directories. So I suspect that perhaps a different port must also be opened/service allowed.

edit: Getting the list of exports to show up on the client required finding out the ports in use by mountd:

$ rpcinfo -p | grep mountd

100005    1   udp  48008  mountd
100005    1   tcp  48008  mountd

I then discovered that mountd uses a static port by inspecting the relevant MOUNTD_PORT line in /etc/sysconfig/nfs. So it was unnecessary to set it.

I then added the port number itself to the list of allowed ports on the public interface:

$ sudo firewall-cmd --zone=public --add-port=48008/udp --permanent
$ sudo firewall-cmd --zone=public --add-port=48008/tcp --permanent

Finally, I discovered that 111 needed to be explicitly specified, so repeated the above commands for it:

$ sudo firewall-cmd --zone=public --add-port=111/udp --permanent
$ sudo firewall-cmd --zone=public --add-port=111/tcp --permanent

Since 111 is a standard NFS port, I don't understand why I had to specify it. I suspect that, since server and client boxes use different versions of OpenSUSE, something probably fell through the cracks.


When trying to connect from a Mac, I found I also had to open port 20048 - the mountd port.

Mac doesn't support NFSv4, and NFSv3 apparently needs mountd as a "side service'" for it to work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .