NFS stands for Network File System.
It is a protocol that allows one computer to share directories with other computers over a network.
The important idea is:
A remote directory can appear like a local directory.For example, a server may export:
/opt/sharedA client may mount it at:
/mnt/nfs_sharedThen users on the client can access remote files as if they were local:
ls /mnt/nfs_sharedNFS has two main sides:
Diagram:
Client Network Server
+--------+ +--------+
| User | file open/read/write requests | NFS |
| Space | <-------------------------------> | Server |
+--------+ +--------+
| |
+--------+ +--------+
| NFS | | NFS |
| Client | | Daemon |
+--------+ +--------+
| |
+--------+ +--------+
| Mount | | Local |
| Point | | Export |
+--------+ +--------+
| |
+--------+ +--------+
| Apps | | Disk |
+--------+ +--------+When a client reads or writes a file under the NFS mount point, the NFS client code sends network requests to the server.
The server receives those requests and performs file operations on its own local filesystem.
NFS is useful when several systems need shared access to files.
Common reasons include:
Example use cases:
NFS is common in Linux and Unix environments, but clients also exist for macOS and Windows.
The NFS server owns and exports the real directory.
The NFS client mounts that exported directory.
Diagram:
Server filesystem:
/
└── opt
└── shared
├── file1.txt
└── file2.txt
Client filesystem:
/
└── mnt
└── nfs_shared
├── file1.txt
└── file2.txtThe files are physically stored on the server, but visible through the client mount point.
Common NFS-related components include:
NFSv3 often depends on several RPC services and ports.
NFSv4 simplifies firewalling because it mainly uses TCP port 2049.
NFS has several versions.
NFSv2 is old and rarely used today.
Limitations include:
NFSv3 is still widely used.
It introduced improvements such as:
NFSv3 is stable and common, but it often requires more firewall considerations because supporting services may use multiple ports.
NFSv4 is newer and usually preferred for modern environments.
Advantages include:
For secure or enterprise environments, NFSv4 with Kerberos is often preferred.
The NFS server needs:
The basic flow is:
On RHEL, CentOS, Rocky, AlmaLinux, or Fedora-style systems:
sudo dnf install nfs-utilsOn older CentOS 7 systems:
sudo yum install nfs-utilsOn Debian or Ubuntu systems:
sudo apt install nfs-kernel-server nfs-commonPackage names vary slightly by distribution, but the main idea is the same:
Example server directory:
sudo mkdir -p /opt/sharedAdd a test file:
echo "hello from NFS server" | sudo tee /opt/shared/hello.txtSet ownership and permissions based on your use case.
For a simple lab:
sudo chmod 755 /opt/sharedFor a shared writable directory, you may use a group:
sudo groupadd nfsusers
sudo chgrp nfsusers /opt/shared
sudo chmod 2775 /opt/sharedThe 2 in 2775 sets the setgid bit so new files tend to inherit the directory group.
/etc/exportsThe server uses /etc/exports to define what directories are shared and who can access them.
Example:
/opt/shared 192.168.1.0/24(rw,sync,root_squash)Meaning:
A more restrictive example:
/opt/shared 192.168.1.50(ro,sync,root_squash)This allows only one client and gives read-only access.
A common safe default:
/opt/shared 192.168.1.0/24(rw,sync,root_squash,no_subtree_check)Important warning:
After editing /etc/exports, apply changes with:
sudo exportfs -rView exports:
sudo exportfs -vExample output:
/opt/shared 192.168.1.0/24(sync,wdelay,hide,no_subtree_check,sec=sys,rw,root_squash,no_all_squash)Interpretation:
On systemd systems:
sudo systemctl enable --now nfs-serverCheck status:
systemctl status nfs-serverExample output:
● nfs-server.service - NFS server and services
Loaded: loaded
Active: active (exited)Interpretation:
On older setups, you may also see or manage:
sudo systemctl enable --now rpcbind
sudo systemctl enable --now nfs-idmapdFor NFSv4, TCP port 2049 is the main port.
For NFSv3, additional RPC services such as mountd and rpcbind may be needed.
With firewalld:
sudo firewall-cmd --permanent --add-service=nfs
sudo firewall-cmd --permanent --add-service=mountd
sudo firewall-cmd --permanent --add-service=rpc-bind
sudo firewall-cmd --reloadCheck:
sudo firewall-cmd --list-servicesExample output:
ssh dhcpv6-client nfs mountd rpc-bindInterpretation:
With UFW, a simple NFSv4 example:
sudo ufw allow from 192.168.1.0/24 to any port 2049 proto tcpThe NFS client needs:
Install packages.
RHEL-style:
sudo dnf install nfs-utilsDebian/Ubuntu:
sudo apt install nfs-commonCreate mount point:
sudo mkdir -p /mnt/nfs_sharedMount:
sudo mount -t nfs 192.168.1.100:/opt/shared /mnt/nfs_sharedFor NFSv4 explicitly:
sudo mount -t nfs4 192.168.1.100:/opt/shared /mnt/nfs_sharedCheck:
mount | grep nfsExample output:
192.168.1.100:/opt/shared on /mnt/nfs_shared type nfs4 (rw,relatime,vers=4.2,addr=192.168.1.100)Interpretation:
List files:
ls -l /mnt/nfs_sharedExample output:
-rw-r--r-- 1 root root 22 Jun 1 12:00 hello.txtRead the test file:
cat /mnt/nfs_shared/hello.txtExample output:
hello from NFS serverCreate a file if write access is allowed:
touch /mnt/nfs_shared/client-test.txtIf this works, the mount is writable for your user.
If it fails with permission denied, check Unix permissions, UID/GID mapping, root squashing, and export options.
/etc/fstabTo mount automatically at boot, add an entry on the client.
Example:
192.168.1.100:/opt/shared /mnt/nfs_shared nfs defaults,_netdev 0 0For NFSv4:
192.168.1.100:/opt/shared /mnt/nfs_shared nfs4 defaults,_netdev 0 0Important option:
_netdev means this mount depends on the network.For systems where the NFS server may not always be available, consider:
192.168.1.100:/opt/shared /mnt/nfs_shared nfs4 defaults,_netdev,nofail,x-systemd.automount 0 0Meaning:
Test fstab:
sudo mount -aCheck:
findmnt /mnt/nfs_sharedNFS permissions are based heavily on numeric user IDs and group IDs.
This is a major concept.
Linux file ownership is stored as numbers:
Example:
id aliceOutput:
uid=1000(alice) gid=1000(alice) groups=1000(alice)If Alice has UID 1000 on the client but UID 2000 on the server, permissions may not behave as expected.
Server thinks alice = UID 2000
NFS sends numeric UID 1000.
This can cause:
Common strategies include:
In small labs, manually matching UIDs may be enough.
In larger environments, use centralized identity management.
idmapdNFSv4 can use name-based identity mapping through idmapd.
The client and server should use the same domain in:
/etc/idmapd.confExample:
[General]
Domain = example.comRestart relevant services after changes.
Example:
sudo systemctl restart nfs-idmapd
sudo systemctl restart nfs-serverCheck identity mapping issues if files appear owned by:
These often indicate mapping problems.
Root squashing protects the server from root users on clients.
With root_squash, a request from UID 0 on the client is mapped to an anonymous user on the server.
Client root UID 0
|
v
NFS server maps it to anonymous user
|
v
Usually nfsnobody or nobodyThis prevents client root from automatically having root privileges on the server export.
Example export:
/opt/shared 192.168.1.0/24(rw,sync,root_squash)Dangerous option:
/opt/shared 192.168.1.0/24(rw,sync,no_root_squash)Use no_root_squash only in carefully controlled environments.
all_squashThe all_squash option maps all client users to the anonymous user.
Example:
/opt/public 192.168.1.0/24(rw,sync,all_squash)This can be useful for simple public drop-box style shares where all access should use one server-side identity.
Common related options:
Example:
/opt/public 192.168.1.0/24(rw,sync,all_squash,anonuid=2000,anongid=2000)This maps all access to UID 2000 and GID 2000.
NFS is powerful, but it must be configured carefully.
Good practices:
A safe export is usually specific:
/srv/project 192.168.10.0/24(rw,sync,root_squash,no_subtree_check)A risky export is broad:
/ *(rw,no_root_squash)Avoid broad exports like that.
NFS performance depends on:
Common mount options include:
Example:
sudo mount -t nfs -o rsize=8192,wsize=8192 192.168.1.100:/opt/shared /mnt/nfs_sharedModern systems often negotiate good defaults automatically. Tune only after measuring.
Important safety note:
exportfsView exports:
sudo exportfs -vReload exports:
sudo exportfs -rUnexport one directory:
sudo exportfs -u 192.168.1.0/24:/opt/sharedUnexport all:
sudo exportfs -uaRe-export all from /etc/exports:
sudo exportfs -aSet up a server export and mount it from a client.
Install packages:
sudo dnf install nfs-utilsCreate directory:
sudo mkdir -p /opt/shared
echo "hello from server" | sudo tee /opt/shared/hello.txt
sudo chmod 755 /opt/sharedEdit /etc/exports:
/opt/shared 192.168.1.0/24(rw,sync,root_squash,no_subtree_check)Apply:
sudo exportfs -r
sudo systemctl enable --now nfs-server
sudo exportfs -vExample output:
/opt/shared 192.168.1.0/24(sync,wdelay,no_subtree_check,sec=sys,rw,root_squash,no_all_squash)Install client tools:
sudo dnf install nfs-utilsCreate mount point:
sudo mkdir -p /mnt/nfs_sharedMount:
sudo mount -t nfs4 192.168.1.100:/opt/shared /mnt/nfs_sharedCheck:
findmnt /mnt/nfs_shared
cat /mnt/nfs_shared/hello.txtExample output:
hello from serverInterpretation:
Show what happens when the client IP is not allowed by /etc/exports.
On the server, restrict the export to the wrong network:
/opt/shared 10.10.10.0/24(rw,sync,root_squash)Apply:
sudo exportfs -rOn the client:
sudo mount -t nfs 192.168.1.100:/opt/shared /mnt/nfs_sharedExample output:
mount.nfs: access denied by server while mounting 192.168.1.100:/opt/sharedsudo exportfs -vExample output:
/opt/shared 10.10.10.0/24(rw,sync,root_squash)Interpretation:
Use the correct client subnet or IP:
/opt/shared 192.168.1.0/24(rw,sync,root_squash,no_subtree_check)Apply:
sudo exportfs -rDiagnose when the export is correct but the client cannot reach NFS services.
On the server, remove NFS firewall services:
sudo firewall-cmd --permanent --remove-service=nfs
sudo firewall-cmd --permanent --remove-service=mountd
sudo firewall-cmd --permanent --remove-service=rpc-bind
sudo firewall-cmd --reloadOn the client:
sudo mount -t nfs 192.168.1.100:/opt/shared /mnt/nfs_sharedPossible output:
mount.nfs: Connection timed outnc -vz 192.168.1.100 2049Example output:
nc: connect to 192.168.1.100 port 2049 (tcp) timed outsudo firewall-cmd --list-servicesExample output:
ssh dhcpv6-clientInterpretation:
sudo firewall-cmd --permanent --add-service=nfs
sudo firewall-cmd --permanent --add-service=mountd
sudo firewall-cmd --permanent --add-service=rpc-bind
sudo firewall-cmd --reloadRetest:
nc -vz 192.168.1.100 2049Expected:
Connection to 192.168.1.100 2049 port [tcp/nfs] succeeded!Show why matching usernames is not enough if numeric UIDs differ.
On server:
alice UID = 1001On client:
alice UID = 1002The server directory is owned by UID 1001:
ls -ln /opt/sharedExample output on server:
drwxr-x--- 2 1001 1001 4096 Jun 1 12:00 /opt/sharedOn client, Alice tries:
touch /mnt/nfs_shared/test.txtExample output:
touch: cannot touch '/mnt/nfs_shared/test.txt': Permission deniedOn client:
id aliceExample:
uid=1002(alice) gid=1002(alice)On server:
id aliceExample:
uid=1001(alice) gid=1001(alice)Interpretation:
Show why root on the client may not have root power on the NFS export.
/opt/shared 192.168.1.0/24(rw,sync,root_squash)Apply:
sudo exportfs -rOn client as root:
sudo touch /mnt/nfs_shared/root-created.txtPossible output:
touch: cannot touch '/mnt/nfs_shared/root-created.txt': Permission deniedOr if the directory allows anonymous writes, check ownership:
ls -ln /mnt/nfs_shared/root-created.txtExample output:
-rw-r--r-- 1 65534 65534 0 Jun 1 12:30 root-created.txtInterpretation:
/opt/shared 192.168.1.0/24(rw,sync,no_root_squash)Warning:
Understand what happens when the server-side exported directory changes while clients still have old references.
Client mounts:
sudo mount -t nfs 192.168.1.100:/opt/shared /mnt/nfs_shared
cd /mnt/nfs_sharedOn the server, rename and recreate the export directory:
sudo mv /opt/shared /opt/shared.old
sudo mkdir /opt/shared
sudo exportfs -rOn the client:
lsPossible output:
ls: cannot access '.': Stale file handleInterpretation:
On the client:
cd /
sudo umount /mnt/nfs_shared
sudo mount /mnt/nfs_sharedIf unmount is busy:
sudo lsof +f -- /mnt/nfs_shared
sudo fuser -vm /mnt/nfs_sharedThen stop the using process or move out of the directory.
/etc/fstabShow why NFS mounts should be configured carefully for boot.
192.168.1.100:/opt/shared /mnt/nfs_shared nfs defaults 0 0If the NFS server is down during boot, the client may wait for a long time.
192.168.1.100:/opt/shared /mnt/nfs_shared nfs4 defaults,_netdev,nofail,x-systemd.automount 0 0sudo systemctl daemon-reload
sudo mount -aCheck systemd mount units:
systemctl list-units | grep nfs_sharedExample output:
mnt-nfs_shared.automount loaded active waiting /mnt/nfs_sharedInterpretation:
Show how export options override client expectations.
/opt/shared 192.168.1.0/24(ro,sync,root_squash)Apply:
sudo exportfs -rClient remount:
sudo umount /mnt/nfs_shared
sudo mount -t nfs 192.168.1.100:/opt/shared /mnt/nfs_sharedTry write:
touch /mnt/nfs_shared/test.txtExample output:
touch: cannot touch '/mnt/nfs_shared/test.txt': Read-only file systemfindmnt /mnt/nfs_sharedExample output:
TARGET SOURCE FSTYPE OPTIONS
/mnt/nfs_shared 192.168.1.100:/opt/shared nfs4 ro,relatime,vers=4.2Interpretation:
Check whether NFS is slow and where the bottleneck may be.
On the client:
dd if=/dev/zero of=/mnt/nfs_shared/testfile bs=1M count=512 conv=fdatasyncExample output:
536870912 bytes copied, 8.2 s, 65.5 MB/sdd if=/mnt/nfs_shared/testfile of=/dev/null bs=1MExample output:
536870912 bytes copied, 4.1 s, 130 MB/snfsiostat 1Example output:
op/s rpc bklog
120.00 0.00
read: avg RTT 4.0 ms avg exe 5.0 ms
write: avg RTT 12.0 ms avg exe 15.0 msInterpretation:
On client:
mount | grep nfs
nfsstat -cOn server:
nfsstat -s
iostat -xz 1Diagnose a client that hangs or reports server not responding.
Client log or terminal shows:
nfs: server 192.168.1.100 not responding, still tryingping 192.168.1.100Check NFS port:
nc -vz 192.168.1.100 2049Example failure:
nc: connect to 192.168.1.100 port 2049 failed: No route to hostOn server:
systemctl status nfs-server
sudo ss -tulnp | grep 2049Example output:
tcp LISTEN 0 64 0.0.0.0:2049 0.0.0.0:*Interpretation:
showmount to Inspect ExportsCheck what the server appears to export.
On client:
showmount -e 192.168.1.100Example output:
Export list for 192.168.1.100:
/opt/shared 192.168.1.0/24Interpretation:
Important note:
Stop sharing a directory without editing many files manually.
Check current exports:
sudo exportfs -vUnexport:
sudo exportfs -u 192.168.1.0/24:/opt/sharedCheck again:
sudo exportfs -vInterpretation:
For a permanent stop, remove or comment out the line in /etc/exports.
Symptoms:
mount.nfs: access denied by serverCheck:
sudo exportfs -v
cat /etc/exports
showmount -e SERVERLikely causes:
Fix:
sudo exportfs -rand correct /etc/exports.
Symptoms:
mount.nfs: Connection timed outCheck:
ping SERVER
nc -vz SERVER 2049
systemctl status nfs-server
sudo firewall-cmd --list-servicesLikely causes:
Symptoms:
touch: Permission deniedCheck:
id
ls -ln /mnt/nfs_shared
ls -ln /opt/shared
sudo exportfs -vLikely causes:
Symptoms:
-rw-r--r-- 1 nobody nobody file.txtor numeric:
4294967294Likely causes:
Check:
cat /etc/idmapd.conf
id username
nfsidmap -lSymptoms:
Stale file handleLikely causes:
Fix:
cd /
sudo umount /mnt/nfs_shared
sudo mount /mnt/nfs_sharedSymptoms:
Fix fstab with:
Example:
192.168.1.100:/opt/shared /mnt/nfs_shared nfs4 defaults,_netdev,nofail,x-systemd.automount 0 0When NFS fails, troubleshoot in layers.
Useful commands:
ping SERVER
nc -vz SERVER 2049
systemctl status nfs-server
sudo exportfs -v
showmount -e SERVER
mount | grep nfs
findmnt /mnt/nfs_shared
id
ls -ln
journalctl -u nfs-server -b
dmesg -T | grep -i nfsServer setup:
sudo dnf install nfs-utils
sudo mkdir -p /opt/shared
sudo vi /etc/exports
sudo exportfs -r
sudo exportfs -v
sudo systemctl enable --now nfs-serverClient setup:
sudo dnf install nfs-utils
sudo mkdir -p /mnt/nfs_shared
sudo mount -t nfs4 SERVER:/opt/shared /mnt/nfs_shared
findmnt /mnt/nfs_sharedFirewall:
sudo firewall-cmd --permanent --add-service=nfs
sudo firewall-cmd --permanent --add-service=mountd
sudo firewall-cmd --permanent --add-service=rpc-bind
sudo firewall-cmd --reloadNFS inspection:
sudo exportfs -v
showmount -e SERVER
nfsstat -s
nfsstat -c
nfsiostat 1
mount | grep nfsPersistent mount:
SERVER:/opt/shared /mnt/nfs_shared nfs4 defaults,_netdev,nofail,x-systemd.automount 0 0Unmount:
sudo umount /mnt/nfs_sharedForce investigation if busy:
sudo lsof +f -- /mnt/nfs_shared
sudo fuser -vm /mnt/nfs_sharedOn the client:
cd /
sudo umount /mnt/nfs_shared 2>/dev/null
sudo rmdir /mnt/nfs_shared 2>/dev/nullRemove fstab test entry if added:
sudo vi /etc/fstab
sudo systemctl daemon-reloadOn the server, remove export line from /etc/exports, then:
sudo exportfs -r
sudo exportfs -vOptionally remove test directory:
sudo rm -rf /opt/shared/opt/shared to one trusted client IP./mnt/nfs_shared and verify it with findmnt.rw to ro, reload exports, remount on the client, and explain the write failure./etc/exports and diagnose the resulting access denied by server error./etc/fstab using _netdev,nofail,x-systemd.automount, then test it with mount -a.nfsstat or nfsiostat to observe NFS activity during a file copy.