diff --git a/modules/build-types/ha-server.nix b/modules/build-types/ha-server.nix
index 5af6c51..2bdca39 100644
--- a/modules/build-types/ha-server.nix
+++ b/modules/build-types/ha-server.nix
@@ -18,11 +18,14 @@
 
 let
   # Generates /etc/exports lines for all nfsShares data entries.
-  # NFS is LAN-only (VLAN 2). Storage-client subnet (VLAN 20) uses iSCSI only.
+  # LAN (VLAN 2): NFS via vip-lan (192.168.2.229) for pxe-boot and other LAN clients.
+  # Storage-client (VLAN 20): NFS via vip-storage (192.168.20.229) for docker and
+  # future swarm nodes; firewall restricts these ports to haClientCidr only.
   mkNfsExports = storageRoot:
     lib.concatMapStrings
       (share:
-        "  ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n")
+        "  ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n" +
+        "  ${storageRoot}/${share.subpath} ${vars.haClientCidr}${vars.nfsShares.options}\n")
       (lib.filter builtins.isAttrs (lib.attrValues vars.nfsShares));
 in
 {
diff --git a/modules/ha/cluster-config.nix b/modules/ha/cluster-config.nix
index e7a6003..7fe7823 100644
--- a/modules/ha/cluster-config.nix
+++ b/modules/ha/cluster-config.nix
@@ -156,6 +156,13 @@ in
       iptables -A nixos-fw -p udp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsd} -j nixos-fw-accept
       iptables -A nixos-fw -p tcp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsMountd} -j nixos-fw-accept
       iptables -A nixos-fw -p udp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsMountd} -j nixos-fw-accept
+
+      iptables -A nixos-fw -p tcp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsRpcbind} -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsRpcbind} -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsd} -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsd} -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsMountd} -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsMountd} -j nixos-fw-accept
     '';
   };
 }