Nfs какой порт

Network File System (NFS) is used by UNIX clients for file access. NFS uses port 2049.

NFSv3 and NFSv2 use the portmapper service on TCP or UDP port 111. The portmapper service is consulted to get the port numbers for services used with NFSv3 or NFSv2 protocols such as mountd, statd, and nlm. NFSv4 does not require the portmapper service.

NFSv4 provides the delegation feature that enables your storage system to grant local file access to clients. To delegate, your storage system sets up a separate connection to the client and sends callbacks on it. To communicate with the client, your storage system uses one of the reserved ports (port numbers less than 1024). To initiate the connection, the client registers the callback program on a random port and informs the server about it.

With delegations enabled, NFSv4 is not firewall-friendly because several other ports need to be opened up as well.

Starting with Data ONTAP 7.3.1, IPv6 over NFS is supported.

You can disable the TCP and UDP ports by setting the nfs.tcp.enable and nfs.udp.enable options to off .

To disable NFS, you should use the nfs off command.

Parent topic: IP port usage on a storage system

Open NFS ports

SharedV4 volumes utilize NFS services, and they therefore require specific open NFS ports to allow for communication between nodes in your cluster. Depending on how your cluster nodes are configured, your firewall may block some of these ports, or your NFS ports may differ from the defaults. To solve these issues, you may need to manually assign NFS ports and ensure that your firewall or ACL allows them to communicate.

Portworx supports the following types of ReadWriteMany volumes:

If a PersistentVolumeClaim (PVC) has ReadWriteMany (RWX) access mode, Portworx creates a sharedv4 service volume by default. Sharedv4 service volumes use NFSv4 by default, which means only port 2049 needs to be opened. However, sharedv4 volumes use NFSv3 by default. If your volumes use another port, see the Manually assign and open NFS ports section.

This document provides instructions for detecting and opening NFS ports according to various cluster configurations that you may have.

Prerequisites

All of the use-cases in this document will require that the mandatory Portworx network port ranges are open between nodes in the cluster, as documented here.

Determine which ports to open

First, check what the existing NFS port configuration is for your nodes to see if they need to be remapped.

Enter the following command to find which ports NFS is using on your node:

rpcinfo -p

SharedV4 volumes communicate on the following standard ports/services:

PortMapper: tcp/udp 111 (default on most Linux distributions)
NFSd: tcp/udp 2049 (default on most Linux distributions)
MountD: tcp/udp 20048 (depends on the Linux distribution)

If the ports listed from the above rpcinfo output on your nodes match these standard ports, proceed to Open standard NFS ports (most Linux distributions).

If the NFS ports on your OS do not match these ports, or your OS randomly chooses the ports for these services, proceed to Manually assign and open NFS ports.

Open standard NFS ports (most Linux distributions)

If your Linux distribution uses the standard ports identified in the previous section, you do not need to manually assign any ports for NFS, but you may need to open them.

Ensure that your ports are open on any firewalls and your ACL by entering the following commands:

iptables -I INPUT -p tcp -m tcp --match multiport --dports 111,2049,20048 -j ACCEPT iptables -I OUTPUT -p tcp -m tcp --match multiport --dports 111,2049,20048 -j ACCEPT

Once you’ve determined that your hosts are using the standard ports and that you have opened those ports, you can start using SharedV4 volumes.

Manually assign and open NFS ports

For certain Linux distributions, the OS chooses the mountd port randomly every time the node reboots. To solve this, you must manually assign NFS ports, and how you accomplish this depends on your OS.

Only perform the steps in one of the following sections if one of the following is true:

The mountd port is not fixed (and not the standard port of 20048) and is chosen at random by your Linux distribution.
You wish to open a contiguous range of ports for Portworx and want to shift the default NFS ports to your Portworx port range.

In order to manually assign and open NFS ports, follow the steps in the section that applies for your OS.

Assign NFS ports on the RedHat family of Linux (RHEL, CentOS, Fedora, etc)

Modify the /etc/sysconfig/nfs file, uncommenting or adding the following fields and assigning the associated values:
- LOCKD_TCPPORT=9023
- LOCKD_UDPPORT=9024
- MOUNTD_PORT=9025
- STATD_PORT=9026
Enter the following command to restart the NFS server:

systemctl restart nfs-server

iptables -I INPUT -p tcp -m tcp --match multiport --dports 111,2049,9023,9025,9026 -j ACCEPT iptables -I OUTPUT -p tcp -m tcp --match multiport --dports 111,2049,9023,9025,9026 -j ACCEPT iptables -I INPUT -p udp -m udp --dport 9024 -j ACCEPT iptables -I OUTPUT -p udp -m udp --dport 9024 -j ACCEPT

Open NFS ports on Debian or Ubuntu Linux

Debian 10 / Ubuntu

Modify the /etc/default/nfs-kernel-server file. Uncomment or add the RPCMOUNTDOPTS field and add the —port 9024 option to the value:

... RPCMOUNTDOPTS="--manage-gids --port 9024"

systemctl restart nfs-mountd.service

Which ports do I need to open in the firewall to use NFS?

I’m running Ubuntu 11.10 — setting up NFS to share a directory among many other servers. Which ports are required to be opened on the firewall?

asked Apr 5, 2012 at 21:01
1,243 2 2 gold badges 9 9 silver badges 6 6 bronze badges

It depends on the version of the protocol you intent to use. NFS 4 only require 2049 while older versions require more.

Sep 11, 2015 at 9:26

8 Answers 8

$ rpcinfo -p | grep nfs

Port 111 (TCP and UDP) and 2049 (TCP and UDP) for the NFS server.

There are also ports for Cluster and client status (Port 1110 TCP for the former, and 1110 UDP for the latter) as well as a port for the NFS lock manager (Port 4045 TCP and UDP). Only you can determine which ports you need to allow depending on which services are needed cross-gateway.

7,665 16 16 gold badges 58 58 silver badges 76 76 bronze badges
answered Apr 5, 2012 at 21:03
32.7k 9 9 gold badges 82 82 silver badges 117 117 bronze badges

I did not know about rpcinfo, that is quite useful. I didn’t see the port 111 with the grep nfs , but I left off the grep to learn that 111 is for portmapper . Also good to know! (and like you mentioned, necessary)

Apr 5, 2012 at 21:12

@KennyYounger rpcinfo is a useful too. If this answered your question, don’t forget to mark it as the answer for the benefit of future viewers.

Apr 5, 2012 at 21:17

You need mountd open when you first mount the filesystem. It runs on a dynamic port, so it won’t always be the same. I put a link to a guide in my answer.

Apr 5, 2012 at 21:23
Thanks @bonsaiviking. Critical info for this process. I upvoted your answer!
Apr 6, 2012 at 0:25

Could you give a brief description of what those services («cluster and client status», «NFS lock manager») do and when they might be needed? If those services are blocked by a firewall, will NFS servers and clients degrade gracefully, or just lock waiting for a response?

Apr 9, 2015 at 0:41

In addition to 111 for portmapper and 2049 for nfs, you will need to allow the mountd port and possibly rquotad, lockd, and statd, all of which can be dynamic. This excellent NFS security guide recommends changing your startup scripts and kernel module configs to force them to use static ports.

In addition to the guide above, which has a section on firewalls, see my answer to another question about hardening NFS.

answered Apr 5, 2012 at 21:22
bonsaiviking bonsaiviking
4,430 17 17 silver badges 27 27 bronze badges

We really do prefer content, not pointers to content. A précis of the content with a link is ok too and preferred to a link.

Apr 5, 2012 at 21:31

Not sure about 2012 but the recommendation in links seems to be grossly outdated. NFS over TCP is preferred for variety of reason and NFS over UDP can cause silent data corruption on fast link due to protocol limitations. Security guide has no mention of Kerberos/GSS etc.

Dec 26, 2016 at 16:46

With respect to mountd, life is a lot easier if you reconfigure to ensure the mountd port is fixed. On debian systems, edit the RPCMOUNTDOPTS value to something like RPCMOUNTDOPTS=»—port 34567″ and then restart with sysctl —system and /etc/init.d/nfs-kernel-server restart

Jan 17, 2019 at 19:53

I found useful directions for my problem on this page, but there was no easy to follow recipe. So here’s my recipe.

TL;DR — need to allow both nfs ports (111, 2049) and mountd port after fixing it.

Setting up a fixed port for mountd

gksudo gedit /etc/default/nfs-kernel-server

comment out this line: RPCMOUNTDOPTS=—manage-gids
add this instead: RPCMOUNTDOPTS=»—port 33333″

Or any other port number.

now try to reset nfs using:

sudo service nfs-kernel-server restart

And test if it helped using:

rpcinfo -p | grep "tcp.*mountd"

For me it wasn’t enough, but a full restart fixed the issue.

Setting up the firewall (ufw)

(1) delete old rules, do this manually or reset if this is the only use for the firewall:

# WARNING: Don't copy & paste this if you don't understand what it does: # sudo ufw reset # sudo ufw enable

(2) add nfs & mountd ports

sudo ufw allow in from 10.0.0.1/20 to any port 111 sudo ufw allow in from 10.0.0.1/20 to any port 2049 sudo ufw allow in from 10.0.0.1/20 to any port 33333

(Change to your local IP’s or to » any » instead of 10.0.0.1/20 )

That’s all there’s to it.

answered Dec 29, 2016 at 16:47
421 4 4 silver badges 6 6 bronze badges

You don’t need to restart the entire box. A simple sudo service nfs-config restart before restarting the nfs-kernel-server will do just fine.

Feb 27, 2017 at 23:29
Or if your system uses systemctl , it’s systemctl restart nfs-kernel-server.service .
Oct 7, 2019 at 20:27

You can also do it all in one swell foop: sudo nfs allow proto tcp from 10.0.0.1/20 to any port 111,2049,33333 followed by (ok, two swell foops) sudo nfs allow proto udp from 10.0.0.1/20 to any port 111,2049,33333 . Note port 33333 is per the above example. You may use another port as the answer indicates.

Oct 7, 2019 at 20:30

@fbicknel I think you can do it in one «swell foop» if you just remove the proto tcp part on the first command 🙂

Apr 24, 2020 at 16:40
@jchook That looks factual to me!
Apr 25, 2020 at 17:14

This will give a list of all ports used by all NFS-related program:

rpcinfo -p | awk '' | sort -k2n | uniq

answered Jul 2, 2017 at 13:54
charlesnadeau charlesnadeau
111 1 1 gold badge 2 2 silver badges 2 2 bronze badges

With FERM one can use Backticks to get the ports from rpcinfo, for example:

proto tcp ); $, = " "; print sort(keys(%ports)),"\n"'`) ACCEPT; # NFS >> proto udp ); $, = " "; print sort(keys(%ports)),"\n"'`) ACCEPT; # NFS >>

proto udp > # NFS

(If you’re only going to use the TCP then you need only the proto tcp part).

3,943 4 4 gold badges 26 26 silver badges 47 47 bronze badges
answered Aug 13, 2013 at 21:39
167 4 4 bronze badges

To mount Synology to Ubuntu 18.04 system, I had to enable ports 111,892,2049

When mounting, here is what I see (NFS 4 is not enabled on my Synology):

root@ub18ovh# mount -a -vv mount.nfs: trying text-based options 'vers=4.2,addr=5.6.7.8,clientaddr=1.2.3.4' mount.nfs: mount(2): Protocol not supported mount.nfs: trying text-based options 'vers=4.1,addr=5.6.7.8,clientaddr=1.2.3.4' mount.nfs: mount(2): Protocol not supported mount.nfs: trying text-based options 'vers=4.0,addr=5.6.7.8,clientaddr=1.2.3.4' mount.nfs: mount(2): Protocol not supported mount.nfs: trying text-based options 'addr=5.6.7.8' mount.nfs: prog 100003, trying vers=3, prot=6 mount.nfs: trying 5.6.7.8 prog 100003 vers 3 prot TCP port 2049 mount.nfs: prog 100005, trying vers=3, prot=17 mount.nfs: trying 5.6.7.8 prog 100005 vers 3 prot UDP port 892 successfully mounted

9.7.3. Running NFS Behind a Firewall

NFS requires rpcbind , which dynamically assigns ports for RPC services and can cause problems for configuring firewall rules. To allow clients to access NFS shares behind a firewall, edit the /etc/sysconfig/nfs configuration file to control which ports the required RPC services run on.

The /etc/sysconfig/nfs may not exist by default on all systems. If it does not exist, create it and add the following variables, replacing port with an unused port number (alternatively, if the file exists, un-comment and change the default entries as required):

MOUNTD_PORT=port
Controls which TCP and UDP port mountd ( rpc.mountd ) uses.
STATD_PORT=port
Controls which TCP and UDP port status ( rpc.statd ) uses.
LOCKD_TCPPORT=port
Controls which TCP port nlockmgr ( lockd ) uses.
LOCKD_UDPPORT=port
Controls which UDP port nlockmgr ( lockd ) uses.

If NFS fails to start, check /var/log/messages . Normally, NFS will fail to start if you specify a port number that is already in use. After editing /etc/sysconfig/nfs , restart the NFS service using service nfs restart . Run the rpcinfo -p command to confirm the changes.

To configure a firewall to allow NFS, perform the following steps:

Procedure 9.1. Configure a firewall to allow NFS

Allow TCP and UDP port 2049 for NFS.
Allow TCP and UDP port 111 ( rpcbind / sunrpc ).
Allow the TCP and UDP port specified with MOUNTD_PORT replaceable»>port»
Allow the TCP and UDP port specified with STATD_PORT replaceable»>port»
Allow the TCP port specified with LOCKD_TCPPORT replaceable»>port»
Allow the UDP port specified with LOCKD_UDPPORT replaceable»>port»

Note

To allow NFSv4.0 callbacks to pass through firewalls set /proc/sys/fs/nfs/nfs_callback_tcpport and allow the server to connect to that port on the client.

This process is not needed for NFSv4.1 or higher, and the other ports for mountd , statd , and lockd are not required in a pure NFSv4 environment.

For more information on configuring NFS behind a firewall, see the following Red Hat Knowledgebase articles:

9.7.3.1. Discovering NFS exports

There are two ways to discover which file systems an NFS server exports.
First, on any server that supports NFSv2 or NFSv3, use the showmount command:

$ showmount -e myserver Export list for mysever /exports/foo /exports/bar

Second, on any server that supports NFSv4, mount / and look around.

# mount myserver:/ /mnt/ #cd /mnt/ exports # ls exports foo bar

On servers that support both NFSv4 and either NFSv2 or NFSv3, both methods will work and give the same results.

Note

Before Red Hat Enterprise Linux 6 on older NFS servers, depending on how they are configured, it is possible to export filesystems to NFSv4 clients at different paths. Because these servers do not enable NFSv4 by default this should not normally be a problem.

Nfs какой порт