NFSv3 is a tried and tested method of allowing client servers to access files over a network, in a very similar fashion to how the files would be accessed on a local file system. As a very mature piece of software, it has been successfully developed and used on production environments for almost 20 years, and it is still widely accepted and supported with a long life ahead of it. Some could make the argument that NFSv4.1 is faster now with pNFS that is now available, but I personally still prefer NFSv3 on many environments.
Setting it up is pretty easy and straight forward. As this is a network file system, it is strongly recommended to setup a private switch or private network between to the servers to ensure the lowest latency, as well as better security.
NFS Server – Installation
Install the required packages on the NFS server:
# CentOS 5 [root@nfs01 ~]# yum install portmap nfs-utils -y # CentOS 6 and CentOS 7 [root@nfs01 ~]# yum install rpcbind nfs-utils -y
NFS Server – Configuration
Out of the box, NFSv3 has the following options set which is getting outdated sorely at this time:
– Sets random ephemeral ports upon daemon startup.
– Enables only 8 NFS threads
To make things more easier for admin’s to lock down the firewalls, we are going to set static ports, and also enable 64 NFS threads since you will most likely run into IO problems before you hit this limit as it was meant for much older systems.
Uncomment or add the following variables in /etc/sysconfig/nfs
[root@nfs01 ~]# vim /etc/sysconfig/nfs # CentOS 5 and CentOS 6 RPCNFSDCOUNT=64 RQUOTAD_PORT=875 LOCKD_TCPPORT=32803 LOCKD_UDPPORT=32769 MOUNTD_PORT=892 STATD_PORT=662 STATD_OUTGOING_PORT=2020 # CentOS 7 RPCRQUOTADOPTS="-p 875" LOCKD_TCPPORT=32803 LOCKD_UDPPORT=32769 RPCNFSDCOUNT=64 RPCMOUNTDOPTS="-p 892" STATDARG="-p 662 -o 2020" GSS_USE_PROXY="no"
Open the firewall to allow your private network access to the NFS services. You may have to adjust your rules as my private network resides on eth2. Do not allow this on the public interface without adjusting the source IP’s accordingly!
# CentOS 5 and CentOS 6 [root@nfs01 ~]# vim /etc/sysconfig/iptables -A INPUT -i eth2 -s 192.168.1.0/24 -p tcp -m tcp --dport 111 -j ACCEPT -A INPUT -i eth2 -s 192.168.1.0/24 -p udp -m udp --dport 111 -j ACCEPT -A INPUT -i eth2 -s 192.168.1.0/24 -p tcp -m tcp --dport 662 -j ACCEPT -A INPUT -i eth2 -s 192.168.1.0/24 -p udp -m udp --dport 662 -j ACCEPT -A INPUT -i eth2 -s 192.168.1.0/24 -p tcp -m tcp --dport 892 -j ACCEPT -A INPUT -i eth2 -s 192.168.1.0/24 -p udp -m udp --dport 892 -j ACCEPT -A INPUT -i eth2 -s 192.168.1.0/24 -p tcp -m tcp --dport 2049 -j ACCEPT -A INPUT -i eth2 -s 192.168.1.0/24 -p udp -m udp --dport 2049 -j ACCEPT -A INPUT -i eth2 -s 192.168.1.0/24 -p tcp -m tcp --dport 32803 -j ACCEPT -A INPUT -i eth2 -s 192.168.1.0/24 -p udp -m udp --dport 32769 -j ACCEPT # CentOS 7 # Note: A space was added in the tags so WordPress wouldn't interpret as markup vim /etc/firewalld/services/nfs.xml <?xml version="1.0" encoding="utf-8"?> <service> <short>NFS <description>NFS service <port protocol="tcp" port="111"/> <port protocol="udp" port="111"/> <port protocol="tcp" port="662"/> <port protocol="udp" port="662"/> <port protocol="tcp" port="892"/> <port protocol="udp" port="892"/> <port protocol="tcp" port="2049"/> <port protocol="udp" port="2049"/> <port protocol="tcp" port="32803"/> <port protocol="udp" port="32803"/> <port protocol="tcp" port="38467"/> <port protocol="udp" port="38467"/> <port protocol="tcp" port="32769"/> <port protocol="udp" port="32769"/> </service> Then apply the rules by: systemctl reload firewalld.service Now add a zone to the private network interface and set PEERDNS to no: vim /etc/sysconfig/network-scripts/ifcfg-eth2 ... PEERDNS=no ZONE=internal ... Then apply the changes by: ifdown eth2 && ifup eth2 Now add the NFS rules to the private network interface: firewall-cmd --zone=internal --add-interface eth2 firewall-cmd --zone=internal --add-service=nfs firewall-cmd --zone=internal --add-interface eth2 --permanent firewall-cmd --zone=internal --add-service=nfs --permanent
Export the directory to be shared, along with its permissions, in /etc/exports:
[root@nfs01 ~]# vim /etc/exports /data 192.168.1.0/24(rw,no_root_squash)
Now start the services, and enable them to start at boot time:
# CentOS 5 [root@nfs01 ~]# service portmap start; chkconfig portmap on [root@nfs01 ~]# service nfslock start; chkconfig nfslock on [root@nfs01 ~]# service nfs start; chkconfig nfs on # CentOS 6 [root@nfs01 ~]# service rpcbind start; chkconfig rpcbind on [root@nfs01 ~]# service nfslock start; chkconfig nfslock on [root@nfs01 ~]# service nfs start; chkconfig nfs on # CentOS 7 [root@nfs01 ~]# systemctl start rpcbind nfs-lock nfs-server [root@nfs01 ~]# systemctl enable rpcbind nfs-lock nfs-server
Check to make sure the services are running:
[root@nfs01 ~]# showmount -e
Export list for nfs01.domain.com:
/data 192.168.1.0/24
[root@nfs01 ~]# rpcinfo -p
program vers proto port service
100000 4 tcp 111 portmapper
100000 3 tcp 111 portmapper
100000 2 tcp 111 portmapper
100000 4 udp 111 portmapper
100000 3 udp 111 portmapper
100000 2 udp 111 portmapper
100024 1 udp 662 status
100024 1 tcp 662 status
100005 1 udp 892 mountd
100005 1 tcp 892 mountd
100005 2 udp 892 mountd
100005 2 tcp 892 mountd
100005 3 udp 892 mountd
100005 3 tcp 892 mountd
100003 2 tcp 2049 nfs
100003 3 tcp 2049 nfs
100003 4 tcp 2049 nfs
100227 2 tcp 2049 nfs_acl
100227 3 tcp 2049 nfs_acl
100003 2 udp 2049 nfs
100003 3 udp 2049 nfs
100003 4 udp 2049 nfs
100227 2 udp 2049 nfs_acl
100227 3 udp 2049 nfs_acl
100021 1 udp 32769 nlockmgr
100021 3 udp 32769 nlockmgr
100021 4 udp 32769 nlockmgr
100021 1 tcp 32803 nlockmgr
100021 3 tcp 32803 nlockmgr
100021 4 tcp 32803 nlockmgr
NFS Client – Installation
Now that the NFS server is ready, the NFS clients now need to be setup to connect. Install the required packages on the NFS clients by:
# CentOS 5 [root@web01 ~]# yum install portmap nfs-utils -y # CentOS 6 and CentOS 7 [root@web01 ~]# yum install rpcbind nfs-utils -y
Now start the services, and enable them to start at boot time.
# CentOS 5 [root@web01 ~]# service portmap start; chkconfig portmap on [root@web01 ~]# service nfslock start; chkconfig nfslock on [root@web01 ~]# chkconfig netfs on # CentOS 6 [root@web01 ~]# service rpcbind start; chkconfig rpcbind on [root@web01 ~]# service nfslock start; chkconfig nfslock on [root@web01 ~]# chkconfig netfs on # CentOS 7 [root@web01 ~]# systemctl start rpcbind nfs-lock [root@web01 ~]# systemctl enable rpcbind nfs-lock
NFS Client – Configuration
Confirm the NFS clients can see the NFS server:
[root@web01 ~]# showmount -e 192.168.1.1
Export list for 192.168.1.1:
/var/www/vhosts 192.168.1.0/24
[root@web01 ~]# rpcinfo -p 192.168.1.1
program vers proto port service
100000 4 tcp 111 portmapper
100000 3 tcp 111 portmapper
100000 2 tcp 111 portmapper
100000 4 udp 111 portmapper
100000 3 udp 111 portmapper
100000 2 udp 111 portmapper
100024 1 udp 662 status
100024 1 tcp 662 status
100005 1 udp 892 mountd
100005 1 tcp 892 mountd
100005 2 udp 892 mountd
100005 2 tcp 892 mountd
100005 3 udp 892 mountd
100005 3 tcp 892 mountd
100003 2 tcp 2049 nfs
100003 3 tcp 2049 nfs
100003 4 tcp 2049 nfs
100227 2 tcp 2049 nfs_acl
100227 3 tcp 2049 nfs_acl
100003 2 udp 2049 nfs
100003 3 udp 2049 nfs
100003 4 udp 2049 nfs
100227 2 udp 2049 nfs_acl
100227 3 udp 2049 nfs_acl
100021 1 udp 32769 nlockmgr
100021 3 udp 32769 nlockmgr
100021 4 udp 32769 nlockmgr
100021 1 tcp 32803 nlockmgr
100021 3 tcp 32803 nlockmgr
100021 4 tcp 32803 nlockmgr
Configure the mount point in /etc/fstab:
[root@web01 ~]# vim /etc/fstab 192.168.1.1:/data /data nfs vers=3,proto=tcp,hard,intr,rsize=32768,wsize=32768,noatime 0 0
Now create the placeholder directory on the client, mount, and verify it works:
[root@web01 ~]# mkdir /data
[root@web01 ~]# mount -a
[root@web01 ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root
14G 1.8G 11G 15% /
tmpfs 939M 0 939M 0% /dev/shm
/dev/sda1 477M 74M 378M 17% /boot
192.168.1.1:/data 14G 1.9G 11G 15% /data
[root@web01 ~]#
[root@web01 ~]# grep /data /proc/mounts
192.168.1.1:/data /data nfs rw,noatime,vers=3,rsize=32768,wsize=32768,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=192.168.1.1,mountvers=3,mountport=892,mountproto=tcp,local_lock=none,addr=192.168.1.1 0 0
[root@web01 ~]#
[root@web01 ~]# touch /data/test-file
[root@web01 ~]# ls -al /data/test-file
-rw-r--r-- 1 root root 0 Dec 19 17:57 /data/test-file