RHEL 7 NFS Access Denied By firewalld Missing Ports

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Clients cannot mount exports and application data paths remain unavailable.

Environment & Reproduction

RHEL 7 NFS server with firewalld enabled rejects client mount attempts despite running nfs-server service.

Root Cause Analysis

Required rpcbind or related NFS service ports are not permitted in active zone policy.

Quick Triage

Check systemctl status nfs-server rpcbind and inspect firewall-cmd –list-services output.

Step-by-Step Diagnosis

Verify zone-interface mapping, test from client subnet, and inspect journalctl for dropped packet traces.

Solution – Primary Fix

Allow nfs, mountd, and rpc-bind services in correct zone, reload firewalld, and retest client mounts.

Solution – Alternative Approaches

Pin static rpc ports and open explicit ports when strict change-control requires precise rules.

Verification & Acceptance Criteria

Clients mount exports successfully and sustained I/O tests run without disconnects.

Rollback Plan

Revert to previous zone export and isolate NFS to trusted VLAN if policy broadening is not acceptable.

Prevention & Hardening

Maintain versioned firewall baselines for storage services and verify after each network change.

Related Errors & Cross-Refs

Related to boot-time NFS mount failures and SELinux context denials on exported directories.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Use RHEL NFS firewall guidance and service dependency documentation.