mjhjmtu

I haven't found a slam-dunk document on this, so let's start one.

On a CentOS 7.1 host, I have gone through the linuxconfig HOW-TO, including the firewall-cmd entries, and I have an exportable filesystem.

[root@<server> ~]# firewall-cmd --list-all
internal (default, active)
 interfaces: enp5s0
 sources: 192.168.10.0/24
 services: dhcpv6-client ipp-client mdns ssh
 ports: 2049/tcp
 masquerade: no
 forward-ports: 
 rich rules: 

[root@<server> ~]# showmount -e localhost
Export list for localhost:
/export/home/<user> *.localdomain

However, if I showmount from the client, I still have a problem.

[root@<client> ~]# showmount -e <server>.localdomain
clnt_create: RPC: Port mapper failure - Unable to receive: errno 113 (No route to host)

Now, how am I sure that this is a firewall problem? Easy. Turn off the firewall. Server side:

[root@<server> ~]# systemctl stop firewalld

And client side:

[root@<client> ~]# showmount -e <server>.localdomain
Export list for <server>.localdomain:
/export/home/<server> *.localdomain

Restart firewalld. Server side:

[root@<server> ~]# systemctl start firewalld

And client side:

[root@<client> ~]# showmount -e <server>.localdomain
clnt_create: RPC: Port mapper failure - Unable to receive: errno 113 (No route to host)

So, let's go to town, by adapting the iptables commands from a RHEL 6 NFS server HOW-TO...

[root@ ~]# firewall-cmd 
> --add-port=111/tcp 
> --add-port=111/udp 
> --add-port=892/tcp 
> --add-port=892/udp 
> --add-port=875/tcp 
> --add-port=875/udp 
> --add-port=662/tcp 
> --add-port=662/udp 
> --add-port=32769/udp 
> --add-port=32803/tcp
success

[root@<server> ~]# firewall-cmd 
> --add-port=111/tcp 
> --add-port=111/udp 
> --add-port=892/tcp 
> --add-port=892/udp 
> --add-port=875/tcp 
> --add-port=875/udp 
> --add-port=662/tcp 
> --add-port=662/udp 
> --add-port=32769/udp 
> --add-port=32803/tcp 
> --permanent
success

[root@<server> ~]# firewall-cmd --list-all
internal (default, active)
 interfaces: enp5s0
 sources: 192.168.0.0/24
 services: dhcpv6-client ipp-client mdns ssh
 ports: 32803/tcp 662/udp 662/tcp 111/udp 875/udp 32769/udp 875/tcp 892/udp 2049/tcp 892/tcp 111/tcp
 masquerade: no
 forward-ports: 
 rich rules: 

This time, I get a slightly different error message from the client:

[root@<client> ~]# showmount -e <server>.localdomain
rpc mount export: RPC: Unable to receive; errno = No route to host

So, I know I'm on the right track. Having said that, why can't I find a definitive tutorial on this anywhere? I can't have been the first person to have to figure this out!

What firewall-cmd entries am I missing?

Oh, one other note. My /etc/sysconfig/nfs files on the CentOS 6 client and the CentOS 7 server are unmodified, so far. I would prefer to not have to change (and maintain!) them, if at all possible.

This should be enough:

firewall-cmd --permanent --add-service=nfs
firewall-cmd --permanent --add-service=mountd
firewall-cmd --permanent --add-service=rpc-bind
firewall-cmd --reload

Just found this - and it works when the problem is SELinux blocking the reading of the ~/.ssh/authorized_keys during login! First, enxure your ~/.ssh/authorized_keys file is properly populated and its permissions and its folder's permissions are set correctly. If you then run "setenforce 0" on the SSH destination host and are able to login to that host without entering a password, but cannot do so after entering "setenforce 1" on that same destination host, the following may fix your issue:

setsebool -P use_nfs_home_dirs 1

ref: https://cassjohnston.wordpress.com/2015/06/12/selinux-nfs-home-directories/

After configuring NFS server we should enable and start three services:

1. nfs-server.service


2. rpcbind.service


3. mound.service

And also allow these services on server firewall:

# firewall-cmd --permanent --add-service=nfs
# firewall-cmd --permanent --add-service=rpcbind
# firewall-cmd --permanent --add-service=mountd
# firewall-cmd --reload

I use nfsv4 and works fine with those lines, supposing your zone is "public" and you are using the default ports 2049 and 4001

firewall-cmd --permanent --add-service=nfs --zone=public
firewall-cmd --permanent --add-service=mountd --zone=public
firewall-cmd --permanent --add-service=rpc-bind --zone=public
firewall-cmd --permanent --add-port=4001/udp --zone=public
firewall-cmd --permanent --add-port=4001/tcp --zone=public
firewall-cmd --permanent --add-port=2049/tcp --zone=public
firewall-cmd --permanent --add-port=2049/udp --zone=public
firewall-cmd --reload