Set Up an NFS Server on Linux: Step-by-Step Guide

Setting up a Network File System (NFS) server lets Linux computers share a directory over a local network, so clients can access files without copying them first. These steps cover a typical Linux server using NFSv4, including installing the server package, defining an export, allowing network access, and testing from a client.

What You’ll Need

• A Linux machine with administrator access, connected to a trusted network. The package and firewall commands vary by distribution.
• A client machine running Linux, if you want to test the share from another computer.
• A directory to share and the client’s IP address or network range. A stable server IP address or DNS name makes the mount easier to maintain.
• Permission to change firewall and network settings. Do not expose an NFS share directly to the public internet.

Step-by-Step

1. Identify your distribution and addresses. On the server, run ip addr to see network interfaces and addresses. Use a reserved or static server address where possible. On the client, identify its address or subnet, such as 192.168.1.0/24. Use the actual values for your network in the examples below.
2. Install NFS server software. On Debian or Ubuntu, run sudo apt update, then sudo apt install nfs-kernel-server. On Fedora, use sudo dnf install nfs-utils. On RHEL-family systems, install nfs-utils with the package manager available on your release. Package names and service handling can differ; check your distribution’s documentation if these commands do not apply.
3. Create a directory for the share. For example, run sudo mkdir -p /srv/nfs/shared. Set ownership and permissions to suit the intended users. A simple test directory can be made readable and writable by a dedicated group, rather than making it world-writable. For example, create a group, add intended users to it, set the directory’s group, and apply suitable group permissions. Avoid using broad permissions such as chmod 777.
4. Configure the export. Open /etc/exports with a text editor as root and add a line like /srv/nfs/shared 192.168.1.0/24(rw,sync,no_subtree_check). Replace the example subnet with the client address or trusted subnet. The options allow read/write access, synchronous writes, and disable subtree checking. To allow read-only access, use ro instead of rw. Keep the client scope as narrow as possible. In this syntax, do not put a space between the client specification and its parentheses; spacing can change how options are interpreted.
5. Apply the export and start the service. Run sudo exportfs -ra to reload exports, then sudo exportfs -v to review what is being shared. On Debian or Ubuntu, start and enable the service with sudo systemctl enable --now nfs-kernel-server. On Fedora or many RHEL-family systems, use sudo systemctl enable --now nfs-server. Check the service with systemctl status nfs-kernel-server or systemctl status nfs-server, as appropriate.
6. Allow NFS through the server firewall. Permit NFS traffic only from the trusted client network. With firewalld, a typical rule is sudo firewall-cmd --permanent --add-service=nfs, followed by sudo firewall-cmd --reload. With UFW, a scoped rule can be added with sudo ufw allow from 192.168.1.0/24 to any port nfs; confirm the rule syntax and active firewall on your system. NFSv4 primarily uses TCP port 2049, but firewall requirements can vary with configuration and NFS version. Do not disable the firewall as a workaround.
7. Install client utilities and mount the share. On Debian or Ubuntu clients, install nfs-common; on Fedora or RHEL-family clients, install nfs-utils. Create a mount point, for example sudo mkdir -p /mnt/shared, then mount the export with sudo mount -t nfs4 SERVER_IP:/srv/nfs/shared /mnt/shared. Replace SERVER_IP with the server’s address. Check with findmnt /mnt/shared and try listing files. If you need to verify write access, create and remove a test file as a user who should have permission.
8. Make the mount persistent if needed. To mount it at boot, add a line to the client’s /etc/fstab, such as SERVER_IP:/srv/nfs/shared /mnt/shared nfs4 defaults,_netdev 0 0. Replace the server address and export path. The _netdev option indicates that the mount depends on the network. Test the entry before relying on it: run sudo umount /mnt/shared, then sudo mount -a, and check for errors. A bad fstab entry can delay boot or leave the mount unavailable, so retain local access while testing.

Common Mistakes

• Using the wrong client range: the address in /etc/exports must match the client’s real IP or subnet. Avoid allowing all hosts unless there is a specific, controlled reason.
• Confusing NFS access with file permissions: export options do not override Linux ownership and mode bits. A client may mount successfully yet receive “Permission denied” when opening a file.
• Forgetting to reload exports: edits to /etc/exports do not take effect until exports are reloaded or the service is restarted.
• Expecting matching usernames to guarantee matching access: traditional NFS access relies on numeric user and group IDs. Different IDs on server and client can produce unexpected ownership. NFSv4 identity mapping and security options may also need deliberate configuration.
• Using a temporary server address: an address change can break client mounts, especially entries in /etc/fstab.

Tips

• Start with a read-only export and a single client if write access is not immediately necessary.
• Use a dedicated share directory rather than exporting a user’s entire home directory or a system directory.
• For files that must be writable by multiple users, plan consistent user and group IDs and set directory group permissions appropriately. The setgid directory bit can help new files inherit the directory’s group.
• Use NFS on a trusted, access-controlled network. For remote access, use a properly secured private network or VPN rather than publishing the service to the internet.
• Check your distribution’s documentation for NFSv4 identity mapping, firewall integration, and security options before using the share for sensitive data.

Troubleshooting

The client cannot reach or mount the share: confirm the server address with ip addr, test basic connectivity with ping where permitted, and check that the relevant NFS service is running. Review firewall rules on both machines and verify that the export permits the client’s actual address. On the server, run sudo exportfs -v to confirm the export is active.

The mount reports that the path is unavailable: confirm that the exported path exists and that the client uses the exact path shown by exportfs -v. Reload exports with sudo exportfs -ra. Check server logs with sudo journalctl -u nfs-server or, on Debian or Ubuntu, sudo journalctl -u nfs-kernel-server.

The share mounts but files are inaccessible: inspect server-side ownership and permissions with ls -ld /srv/nfs/shared. Check numeric identities using id on both machines. Verify that the export uses the intended access mode and that client and server identity-mapping settings are compatible.

A persistent mount fails at boot: test the fstab line with sudo mount -av while the system is running. Check for typos, a missing mount-point directory, unavailable networking, or an incorrect export path. Remove or correct a failing entry before rebooting.

Frequently Asked Questions

What is NFS used for?
NFS lets a client access files in a directory exported by another computer over a network, as though the directory were mounted locally.

Does the client need to run an NFS server?
No. A client needs NFS client utilities to mount and use a share. It needs server software only if it will export directories of its own.

Should I use NFSv3 or NFSv4?
For a new Linux setup, NFSv4 is a common starting point and often simplifies firewall handling. Use the version required by your environment and verify server and client compatibility.

Why can I mount the share but not write to it?
The export may be read-only, or the server-side directory permissions and user IDs may not grant write access. Check both export options and ownership rather than broadly opening permissions.

Can I expose an NFS server to the internet?
Do not expose it directly. Restrict access to a trusted network and use a secured private connection, such as a properly configured VPN, for remote clients.

Related

• ChatGPT DALL·E 3 Prompts With Midjourney
• How to Import Facebook Friends to Google Contacts
• Safari Connection Not Private: Fix It on iPhone, iPad & Mac