Back to blog

Storage

How to Configure NFS on Linux: Server Setup, Exports & Client Mounts

Sets up NFS v4 server, configures /etc/exports with security options, mounts shares on clients, and automates with /etc/fstab.

  • Linux
  • NFS
  • Storage
  • Ubuntu
  • Filesystems
  • Administration

SEO Metadata

SEO Title Options

  1. How to Configure NFS on Linux: Server Setup, Exports
  2. How to Configure NFS on Linux: Server: Practical 2026
  3. Storage Playbook: How to Configure NFS on Linux: Server

Meta Description Options

  1. Learn How to Configure NFS on Linux: Server Setup, Exports & Client Mounts with a practical Storage framework, expert mistakes, implementation steps.
  2. Sets up NFS v4 server, configures /etc/exports with security options, mounts shares on clients, and automates with /etc/fstab.

URL Slug

how-configure-nfs-linux-server-setup-exports-client-mounts

Focus Keyword

How to Configure NFS on Linux: Server Setup, Exports & Client Mounts

Additional LSI Keywords

  • Storage
  • Linux
  • NFS
  • Ubuntu
  • Filesystems
  • Administration
  • How to Configure NFS on Linux: Server Setup, Exports & Client Mounts
  • production checklist
  • implementation guide
  • best practices
  • architecture decisions
  • testing strategy

Table of Contents

Article overview

How to Configure NFS on Linux: Server Setup, Exports & Client Mounts is the kind of topic that looks simple until it reaches production. Teams usually discover the real cost late: unclear boundaries, weak defaults, hidden maintenance work, and decisions that seemed harmless when the codebase was small.

The problem gets worse when the article, tutorial, or implementation guide only explains the happy path. This guide closes that gap with a practical framework, a comparison table, common mistakes, and a deep technical section you can use while planning real work.

Keep reading for the non-obvious part: the safest implementation is rarely the most impressive-looking one. It is the one your team can debug, test, document, and evolve without turning every future change into archaeology.

Key Takeaways

  • How to Configure NFS on Linux: Server Setup, Exports & Client Mounts should be evaluated as a production decision, not only as a syntax or tooling choice.
  • The best implementation keeps responsibilities visible, with clear ownership, tests, documentation, and rollback paths.
  • Search visibility improves when practical depth, structured answers, and expert examples live on the same page.

[IMAGE: A mobile-first technical article layout showing the main concept, decision table, implementation checklist, and FAQ blocks. Alt: How to Configure NFS on Linux: Server Setup, Exports & Client Mounts expert guide for Storage]

What How to Configure NFS on Linux: Server Setup, Exports & Client Mounts means

How to Configure NFS on Linux: Server Setup, Exports & Client Mounts means applying storage knowledge to a concrete engineering decision, then turning that decision into reliable code, documentation, and operational behavior. In practice, it combines the topic's core concepts with trade-off analysis, implementation boundaries, testing strategy, and maintenance discipline.

This is the definition worth optimizing for featured snippets because it avoids hype. It tells the reader what the topic does and what a professional implementation must include.

Why it matters now

The technical web is more crowded than it was a few years ago. Thin tutorials can still get indexed, but they rarely earn trust from senior developers, buyers, AI answer systems, or teams that need production guidance.

For storage topics, the strongest content now has three layers:

  • a clear answer for fast scanning
  • a practical framework for implementation
  • expert context that explains what breaks later

That same structure helps search engines understand the page. It also helps readers decide whether the advice fits their project.

Implementation framework

Use this framework before adopting the approach described in this article.

  1. Define the user problem and the production risk.
  2. Identify the smallest reliable implementation boundary.
  3. Keep configuration, secrets, and environment-specific behavior outside the article's core logic.
  4. Add tests for the behavior that would hurt if it regressed.
  5. Document the trade-off, not only the final code.
  6. Measure the result with logs, metrics, or user-facing outcomes.
  7. Revisit the decision after real usage exposes edge cases.

The sequence is deliberately conservative. It keeps the work grounded in outcomes instead of novelty.

[IMAGE: A seven-step implementation framework with discovery, boundary design, configuration, tests, documentation, measurement, and iteration. Alt: How to Configure NFS on Linux: Server Setup, Exports & Client Mounts implementation framework]

Practical comparison

Decision areaStrong approachWeak approachWhy it matters
ScopeSolve one clear problemMix unrelated concernsFocus improves testing and search intent
ArchitecturePut logic in explicit classes or documented boundariesHide behavior in templates or incidental callbacksFuture changes stay easier to review
Data flowPass prepared data into the view or endpointQuery or compute in presentation codeReduces regressions and performance surprises
TestingCover the risky behavior directlyTest only the happy pathCatches production failures earlier
DocumentationExplain trade-offs and limitsRepeat generic definitionsBuilds E-E-A-T and reader trust
OperationsTrack logs, metrics, and rollback stepsShip without measurementMakes the decision reversible

This table is intentionally practical. It gives a reviewer something to check before the implementation becomes expensive to change.

Expert workflow

Expert tip: "Treat How to Configure NFS on Linux: Server Setup, Exports & Client Mounts as a system boundary. If the next developer cannot find where the decision lives, how it is tested, and when it should be avoided, the implementation is not finished."

A useful workflow is simple:

  • Start with the smallest working example.
  • Add the constraints that exist in your real project.
  • Remove anything that only demonstrates cleverness.
  • Write down the failure modes.
  • Add links to related decisions so future readers can navigate the topic cluster.

That last point matters for both humans and search systems. A single article can answer a question; a cluster proves authority.

Common mistakes

Mistake 1: Copying a pattern without its context

A pattern that works in a small demo can fail in a real application. The missing context is usually data volume, team experience, deployment process, security requirements, or observability.

Before copying the pattern, ask what assumption made it safe in the original example.

Mistake 2: Putting business logic in the wrong layer

This is the fastest way to make future debugging expensive. In Laravel, PHP, and server-rendered websites, presentation should receive prepared data, not discover rules on its own.

Keep decision logic in models, actions, services, policies, requests, jobs, or documented helpers where it can be tested directly.

Mistake 3: Optimizing for novelty instead of maintainability

Newer tools and language features can be valuable. They can also hide simple behavior behind unfamiliar syntax.

Use the option that makes the next production incident easier to understand.

Mistake 4: Publishing without a measurement plan

If the article describes a performance, SEO, security, or architecture improvement, define how success will be checked. Logs, tests, crawl diagnostics, analytics, and user behavior are all stronger than assumptions.

[IMAGE: A common-mistakes board with context loss, wrong layer, novelty bias, and missing measurement highlighted. Alt: How to Configure NFS on Linux: Server Setup, Exports & Client Mounts common mistakes]

Image placeholders

  • [IMAGE: A concept diagram for How to Configure NFS on Linux: Server Setup, Exports & Client Mounts with input, decision boundary, implementation, tests, and production feedback. Alt: How to Configure NFS on Linux: Server Setup, Exports & Client Mounts concept diagram]
  • [IMAGE: A mobile screenshot-style checklist for How to Configure NFS on Linux: Server Setup, Exports & Client Mounts. Alt: How to Configure NFS on Linux: Server Setup, Exports & Client Mounts mobile checklist]
  • [IMAGE: A comparison table visualization for strong versus weak implementation choices. Alt: How to Configure NFS on Linux: Server Setup, Exports & Client Mounts comparison table]

Video placeholder

[VIDEO: Insert a 5-8 minute YouTube walkthrough that demonstrates the main decision, the implementation boundary, the test strategy, and the production caveats for How to Configure NFS on Linux: Server Setup, Exports & Client Mounts.]

Internal linking opportunities

Original Technical Deep Dive

The short version

NFS is good for Linux-to-Linux file sharing on trusted networks. It is not a replacement for backups, object storage, block storage, database replication, or a distributed filesystem.

Use this baseline:

NFSv4
specific client subnets
sync
root_squash
no_subtree_check for normal writable shares
firewall limited to trusted clients
stable UIDs and GIDs across hosts
fstab with _netdev or systemd automount

Minimal server export:

/srv/nfs/projects 10.20.30.0/24(rw,sync,root_squash,no_subtree_check)

Minimal client mount:

sudo mount -t nfs -o nfsvers=4.2 nfs1.example.com:/srv/nfs/projects /mnt/projects

Persistent client mount:

nfs1.example.com:/srv/nfs/projects /mnt/projects nfs nfsvers=4.2,rw,hard,_netdev,noatime 0 0

Do not publish NFS to the public Internet.

Plan the share

Example network:

RoleHostAddress
NFS servernfs1.example.com10.20.0.10
Client subnetapp servers10.20.30.0/24
Export pathserver path/srv/nfs/projects
Client mountlocal path/mnt/projects

Decide these before editing configs:

  • Which clients can mount the share?
  • Is the share read-only or read-write?
  • Which Linux users need access?
  • Are UID and GID values consistent across clients?
  • Is this for interactive home directories, app uploads, VM images, backups, or build artifacts?
  • What happens when the NFS server is unavailable?

NFS with the default sec=sys security model trusts client-provided UID and GID values. If client hosts are not trusted, use Kerberos-backed NFS or a different storage design.

Install the server

Ubuntu or Debian server:

sudo apt update
sudo apt install -y nfs-kernel-server

Enable and start:

sudo systemctl enable --now nfs-kernel-server.service
sudo systemctl status nfs-kernel-server.service --no-pager

RHEL, Rocky Linux, AlmaLinux, or Fedora:

sudo dnf install -y nfs-utils
sudo systemctl enable --now nfs-server
sudo systemctl status nfs-server --no-pager

Check supported server versions:

cat /proc/fs/nfsd/versions

Typical output contains enabled versions marked with +:

-2 +3 +4 +4.1 +4.2

If you only need NFSv4, you can disable v3 later. Get a working export first.

Create the export directory

Create a shared group:

sudo groupadd --system projectshare

Create the export:

sudo install -d -o root -g projectshare -m 2770 /srv/nfs/projects

The 2 in 2770 sets the setgid bit on the directory. New files created in the directory inherit the group.

Verify:

ls -ld /srv/nfs/projects

Expected shape:

drwxrws--- 2 root projectshare ... /srv/nfs/projects

If the clients need user-level write access, users on clients and server need matching UID/GID values or a central identity system such as LDAP, SSSD, or Active Directory integration.

Configure /etc/exports

Back up the file:

sudo cp /etc/exports /etc/exports.$(date +%F).bak

Open it:

sudoedit /etc/exports

Add:

/srv/nfs/projects 10.20.30.0/24(rw,sync,root_squash,no_subtree_check)

Important: do not put a space between the client and the option list.

Correct:

/srv/nfs/projects 10.20.30.0/24(rw,sync,root_squash,no_subtree_check)

Wrong:

/srv/nfs/projects 10.20.30.0/24 (rw,sync,root_squash,no_subtree_check)

That space changes how the export line is parsed.

Understand export options

Use explicit options so future readers do not have to infer security behavior.

OptionMeaningDefault posture
roRead-only exportBest for shared artifacts and package mirrors
rwRead-write exportUse only for trusted clients and write workloads
syncReply after changes are committed as required by the serverSafer default
asyncAllows faster replies before durable writebackRiskier during crashes
root_squashMaps remote root to an anonymous userKeep enabled for most exports
no_root_squashRemote root remains root on the server filesAvoid unless tightly justified
all_squashMaps all users to the anonymous userUseful for shared drop zones
anonuidAnonymous UID used with squash optionsPair with a dedicated user
anongidAnonymous GID used with squash optionsPair with a dedicated group
subtree_checkChecks path inside exported subtreeCan cause issues when files move
no_subtree_checkDisables subtree checkingCommon for whole-share exports

[IMAGE: Supporting visual 1 for How to Configure NFS on Linux: Server Setup, Exports & Client Mounts, showing How to Configure NFS on Linux: Server Setup, Exports & Client Mounts decisions, examples, and Linux, NFS, Storage. Alt: How to Configure NFS on Linux: Server Setup, Exports & Client Mounts how-configure-nfs-linux-server-setup-exports-client-mounts visual 1]

[IMAGE: Supporting visual 1 for How to Configure NFS on Linux: Server Setup, Exports & Client Mounts, showing How to Configure NFS on Linux: Server Setup, Exports & Client Mounts decisions, examples, and Linux, NFS, Storage. Alt: How to Configure NFS on Linux: Server Setup, Exports & Client Mounts how-configure-nfs-linux-server-setup-exports-client-mounts visual 1]

Use ro when clients do not need writes:

/srv/nfs/releases 10.20.30.0/24(ro,sync,root_squash,no_subtree_check)

Use all_squash for a simple shared write target:

sudo useradd --system --no-create-home --shell /usr/sbin/nologin nfsdrop
id nfsdrop

Then export:

/srv/nfs/dropbox 10.20.30.0/24(rw,sync,all_squash,anonuid=997,anongid=997,no_subtree_check)

Replace 997 with the real UID/GID from id nfsdrop.

Apply exports

Reload exports:

sudo exportfs -rav

List active exports:

sudo exportfs -v

Restart the service if needed:

sudo systemctl restart nfs-kernel-server.service

Check listeners:

sudo ss -tulpn | grep -E ':(111|2049)\b'

For NFSv4-only clients, TCP port 2049 is the key port. NFSv3 also involves rpcbind and additional RPC services, which is one reason to prefer NFSv4 for new setups.

Configure the firewall

UFW:

sudo ufw allow from 10.20.30.0/24 to any port 2049 proto tcp
sudo ufw status verbose

firewalld:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.20.30.0/24" service name="nfs" accept'
sudo firewall-cmd --reload

Do not open NFS broadly:

sudo ufw allow 2049/tcp

That may be acceptable on an isolated lab network, but it is a bad default for real infrastructure.

Install the client

Ubuntu or Debian client:

sudo apt update
sudo apt install -y nfs-common

RHEL, Rocky Linux, AlmaLinux, or Fedora client:

sudo dnf install -y nfs-utils

Create a mount point:

sudo install -d -m 0755 /mnt/projects

Test DNS and routing:

getent hosts nfs1.example.com
ip route get 10.20.0.10

Check available exports:

showmount -e nfs1.example.com

showmount is useful, but it depends on RPC services and may not tell the full story on locked-down NFSv4-only systems. A direct mount test is more important.

Mount the share manually

Mount with NFSv4.2:

sudo mount -t nfs -o nfsvers=4.2,rw,hard nfs1.example.com:/srv/nfs/projects /mnt/projects

Verify:

mount | grep /mnt/projects
findmnt /mnt/projects
df -h /mnt/projects

Write test:

touch /mnt/projects/client-test
ls -l /mnt/projects/client-test
rm /mnt/projects/client-test

If write fails, check:

  • export is rw;
  • server directory permissions;
  • client UID/GID matches server expectations;
  • root is being squashed;
  • firewall allows traffic;
  • AppArmor or SELinux is not blocking the daemon;
  • the filesystem is not mounted read-only.

Unmount:

sudo umount /mnt/projects

Configure /etc/fstab

Open fstab:

sudoedit /etc/fstab

Add a normal persistent mount:

nfs1.example.com:/srv/nfs/projects /mnt/projects nfs nfsvers=4.2,rw,hard,_netdev,noatime 0 0

Test without rebooting:

sudo mount -a
findmnt /mnt/projects

Use _netdev so the mount is treated as network-dependent.

For servers that must boot even when NFS is down, use systemd automount:

nfs1.example.com:/srv/nfs/projects /mnt/projects nfs nfsvers=4.2,rw,hard,_netdev,noauto,x-systemd.automount,x-systemd.idle-timeout=600,noatime 0 0

Reload systemd and test:

sudo systemctl daemon-reload
sudo systemctl restart remote-fs.target
findmnt /mnt/projects
ls /mnt/projects

The first access triggers the mount. This avoids boot blocking when the NFS server is temporarily unavailable.

Choose hard or soft mounts

For most write workloads, use hard mounts:

hard

A hard mount retries operations while the server is unavailable. That can make processes wait, but it avoids silent partial writes and surprising I/O errors.

Use soft mounts only for read-mostly or disposable workloads where application-level error handling is correct:

soft,timeo=50,retrans=3

[IMAGE: Supporting visual 2 for How to Configure NFS on Linux: Server Setup, Exports & Client Mounts, showing How to Configure NFS on Linux: Server Setup, Exports & Client Mounts decisions, examples, and Linux, NFS, Storage. Alt: How to Configure NFS on Linux: Server Setup, Exports & Client Mounts how-configure-nfs-linux-server-setup-exports-client-mounts visual 2]

Do not put databases, queues, or critical mutable state on a soft NFS mount unless the application was designed and tested for that failure mode.

Export an NFSv4 pseudo-root

Some environments prefer an NFSv4 pseudo-root with fsid=0.

Server layout:

/srv/nfs
/srv/nfs/projects
/srv/nfs/releases

Exports:

/srv/nfs          10.20.30.0/24(ro,fsid=0,crossmnt,sync,root_squash,no_subtree_check)
/srv/nfs/projects 10.20.30.0/24(rw,sync,root_squash,no_subtree_check)
/srv/nfs/releases 10.20.30.0/24(ro,sync,root_squash,no_subtree_check)

Reload:

sudo exportfs -rav

Clients can then mount paths relative to the pseudo-root:

sudo mount -t nfs -o nfsvers=4.2 nfs1.example.com:/projects /mnt/projects
sudo mount -t nfs -o nfsvers=4.2 nfs1.example.com:/releases /mnt/releases

[IMAGE: Supporting visual 2 for How to Configure NFS on Linux: Server Setup, Exports & Client Mounts, showing How to Configure NFS on Linux: Server Setup, Exports & Client Mounts decisions, examples, and Linux, NFS, Storage. Alt: How to Configure NFS on Linux: Server Setup, Exports & Client Mounts how-configure-nfs-linux-server-setup-exports-client-mounts visual 2]

Use this layout when you want a clean NFSv4 namespace. For simple single-share setups, exporting the real path directly is easier to reason about.

Disable NFSv3 when appropriate

After all clients use NFSv4, consider disabling v3 to reduce moving parts.

On Ubuntu, edit:

sudoedit /etc/nfs.conf

Use:

[nfsd]
vers3=n
vers4=y
vers4.1=y
vers4.2=y

Restart:

sudo systemctl restart nfs-kernel-server.service

Verify:

cat /proc/fs/nfsd/versions

Make sure no legacy clients still need NFSv3 before doing this.

Troubleshooting order

Use this order on the server:

sudo exportfs -v
sudo exportfs -rav
systemctl status nfs-kernel-server.service --no-pager
sudo journalctl -u nfs-kernel-server.service --since '30 minutes ago' --no-pager
sudo ss -tulpn | grep -E ':(111|2049)\b'
ls -ld /srv/nfs/projects

Use this order on the client:

getent hosts nfs1.example.com
ip route get 10.20.0.10
showmount -e nfs1.example.com
sudo mount -vvv -t nfs -o nfsvers=4.2 nfs1.example.com:/srv/nfs/projects /mnt/projects
findmnt /mnt/projects
dmesg | tail -80

Common failures:

SymptomLikely cause
access denied by serverclient IP does not match export, wrong export path, export not reloaded
permission denied on writeUnix permissions, UID/GID mismatch, root squashing, read-only export
mount hangsfirewall, routing, server down, DNS, blocked TCP 2049
boot waits for NFSmissing _netdev, no systemd automount, server unavailable
root cannot writeexpected behavior from root_squash
files have wrong ownerinconsistent UID/GID mapping across hosts
stale file handleserver-side file moved or deleted while client held a handle

If the network path is correct but application writes fail, stop changing NFS options and inspect ownership, mode bits, ACLs, and application users.

Production checklist

[ ] NFS is limited to trusted private networks.
[ ] Exports use explicit client hosts or subnets.
[ ] Export options are explicit.
[ ] root_squash is enabled unless there is a documented exception.
[ ] no_root_squash is not used for convenience.
[ ] UID/GID mapping is stable across clients.
[ ] Firewall permits only required clients.
[ ] Clients use NFSv4 where possible.
[ ] fstab entries are tested with mount -a.
[ ] Boot behavior is tested with the NFS server unavailable.
[ ] Monitoring checks server availability and client mount state.
[ ] NFS data is backed up independently.

FAQ

What is How to Configure NFS on Linux: Server Setup, Exports & Client Mounts?

How to Configure NFS on Linux: Server Setup, Exports & Client Mounts is a practical storage topic that should be evaluated through implementation scope, production risk, testing, documentation, and long-term maintainability.

When should a team use How to Configure NFS on Linux: Server Setup, Exports & Client Mounts?

Use How to Configure NFS on Linux: Server Setup, Exports & Client Mounts when it solves a real project constraint, improves clarity, or reduces operational risk. Avoid it when it only adds novelty or hides behavior from future maintainers.

What is the biggest risk with How to Configure NFS on Linux: Server Setup, Exports & Client Mounts?

The biggest risk is copying a pattern without its context. Production systems need clear boundaries, rollback options, tests, and observability before a technique becomes dependable.

How do you test How to Configure NFS on Linux: Server Setup, Exports & Client Mounts?

Test the smallest unit that owns the behavior, then add integration coverage for the path users or systems actually rely on. Include failure cases, configuration differences, and regression checks.

How does How to Configure NFS on Linux: Server Setup, Exports & Client Mounts affect SEO and AI search visibility?

It improves visibility when the article gives a direct answer, expert context, structured headings, internal links, trustworthy references, and FAQ content that matches the visible page.

Conclusion

How to Configure NFS on Linux: Server Setup, Exports & Client Mounts is worth doing when the implementation improves clarity, reliability, or delivery speed. It is not worth doing when it hides ownership, increases operational risk, or makes the system harder to explain.

Use the framework above as a review checklist. Then connect this topic to the rest of the project documentation so readers can move from concept to implementation without losing context.

Top