What changes between NFSv3 and NFSv4
| Protected scenario | Fixed by the protocol | Assigned locally | Important boundary |
|---|---|---|---|
| NFSv3 server | TCP 111 and 2049 | mountd, statd, lockd, and optional rquotad | Legacy UDP is added only when selected. |
| NFSv3 client | TCP 111 | statd and lockd | Server-only nfs and mountd listeners are excluded. |
| NFSv4.0 | Server TCP 2049 | Client callback TCP port | Plan the server and client host firewalls separately. |
| NFSv4.1 or later | Server TCP 2049 | None in this model | The client uses its established session for callbacks. |
Verify NFSv3 helper ports on the protected host
NFSv3 helper programs can use ports assigned by the local system. Read the relevantmountd, statd, and lockd settings from the host, then confirm active listeners with rpcinfo -p and ss -lntup. The nfs.conf manual names the configuration keys. Treat port numbers in articles as examples, not local facts.
Leave a helper field empty until its value is verified. An incomplete result shows only the protocol-fixed rows and names the missing facts. It deliberately withholds firewall syntax and copy output, so a partial set cannot look ready to apply.
Treat the output as a review plan
The listener table is the neutral result. It identifies the protected host, inbound direction, allowed peer, service, protocol, destination port, and whether that port is fixed by the protocol or supplied from the real host. Review this table before the selected firewall syntax.
Firewalld output needs the active zone. UFW output assumes the matching address family is enabled. Nftables output is an expression for an existing inet input chain, not a new table, hook, policy, or complete ruleset. These are review fragments, not apply scripts, and existing rule order can change their effect.
What the planner cannot verify
The planner does not read your listeners, firewall, routes, exports, permissions, SELinux policy, identity mapping, NAT, or cloud controls. It cannot prove that a rule is active, that an export is allowed, or that a mount is reachable. Routed firewalls, security groups, clustered NFS, Kerberos, RDMA, TLS, and vendor-specific NAS services are outside this model.
Entered values stay in this browser and are not added to the URL or saved by the planner. Follow the verification steps shown with the result from the NFS client, and compare the real listeners with the RHEL NFS server documentation. See the privacy policy for the sitewide boundary.