Oracle Linux 10 – NFS exports inaccessible due to firewalld zone mismatch – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

NFS clients time out mounting exports although server-side export config appears correct.

Environment & Reproduction

Occurs when active NIC is attached to a different firewalld zone than expected.

exportfs -v
systemctl status nfs-server
showmount -e localhost

Root Cause Analysis

Required NFS-related services are not enabled in the zone bound to active interface.

Quick Triage

Validate zone/interface mapping and current service exposure.

firewall-cmd --get-active-zones
firewall-cmd --zone=public --list-services
ss -lntup | grep -E '2049|111'

Step-by-Step Diagnosis

Cross-check mountd/rpcbind accessibility and SELinux context.

rpcinfo -p localhost
getenforce
ausearch -m avc -ts recent | tail -n 20

Solution – Primary Fix

Enable NFS services in active zone and reload firewall.

sudo firewall-cmd --zone=public --add-service=nfs --add-service=mountd --add-service=rpc-bind --permanent
sudo firewall-cmd --reload
sudo systemctl restart nfs-server

Solution – Alternative Approaches

Bind server NIC to dedicated storage zone with tightly scoped source ranges.

sudo firewall-cmd --permanent --new-zone=storage
sudo firewall-cmd --permanent --zone=storage --add-source=10.20.0.0/16

Verification & Acceptance Criteria

Clients can mount exports and perform read/write operations.

showmount -e localhost
firewall-cmd --list-all
mount -t nfs localhost:/srv/nfs /mnt

Rollback Plan

Remove added services if exposure exceeds policy.

sudo firewall-cmd --permanent --zone=public --remove-service=nfs --remove-service=mountd --remove-service=rpc-bind
sudo firewall-cmd --reload

Prevention & Hardening

Document zone ownership per interface and audit drift after network changes.

firewall-cmd --get-active-zones
firewall-cmd --permanent --list-all-zones

Related Errors & Cross-Refs

Related to `/etc/exports` host ACL mismatch, idmap domain inconsistencies, and SELinux export booleans.

Related tutorial: View the step-by-step tutorial for oracle-linux-10.

View all oracle-linux-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL NFS server and firewalld integration documentation.