From 2e9d3da301e23505e06745c36c8a575c094448f6 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Mon, 27 Jul 2026 03:56:39 +1000 Subject: [PATCH] fix(server): open mountd port 20048 so NFS clients can scan and mount MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit showmount and the NFSv3 mount protocol need mountd reachable after querying portmapper on 111; the server was only opening TCP 111 and 2049, causing clients (e.g. Proxmox GUI NFS storage scan) to time out connecting to mountd on 20048. Also adds UDP for all three ports — portmapper, nfsd, and mountd all use both protocols. Co-Authored-By: Claude Sonnet 4.6 --- modules/build-types/server.nix | 6 +++++- variables.nix | 8 ++++++-- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/modules/build-types/server.nix b/modules/build-types/server.nix index c55291a..882a5b4 100644 --- a/modules/build-types/server.nix +++ b/modules/build-types/server.nix @@ -88,5 +88,9 @@ in ''; }; - networking.firewall.allowedTCPPorts = [ vars.ports.nfsRpcbind vars.ports.nfsd ]; + # mountd (20048) is needed for showmount/NFSv3 mount protocol — without it + # clients can reach portmapper (111) and get the mountd port back, then + # time out trying to connect to it. All three ports need TCP and UDP. + networking.firewall.allowedTCPPorts = [ vars.ports.nfsRpcbind vars.ports.nfsd vars.ports.nfsMountd ]; + networking.firewall.allowedUDPPorts = [ vars.ports.nfsRpcbind vars.ports.nfsd vars.ports.nfsMountd ]; } diff --git a/variables.nix b/variables.nix index f6a34b5..9f27d49 100644 --- a/variables.nix +++ b/variables.nix @@ -137,10 +137,14 @@ # (modules/build-types/pxe-boot.nix). pxeBootTftp = 69; - # `server`'s NFS exports need both the portmapper (rpcbind) and the - # NFS data port itself opened (modules/build-types/server.nix). + # `server`'s NFS exports: portmapper (rpcbind), NFS data, and the + # mountd RPC service (used by showmount/NFSv3 mount protocol). + # Mountd listens on a fixed port so the firewall can whitelist it + # explicitly rather than opening all of rpcbind's dynamic range. + # All three need both TCP and UDP (modules/build-types/server.nix). nfsRpcbind = 111; nfsd = 2049; + nfsMountd = 20048; # Opened on the docker host's firewall for the Traefik-fronted # container stack (docker-compose config lives in the separate