2049

Port 2049 – NFS

TCP/UDP

Port 2049 is the NFS (Network File System) port for mounting remote filesystems over a network. NFSv4 uses TCP port 2049 exclusively. NFSv3 uses both TCP and UDP 2049 plus additional ports via portmapper (111). NFS traffic should be restricted to trusted internal networks – NFS has no built-in encryption and older versions have weak authentication.

Port Number

2049

Protocol

TCP/UDP

Service

Network File System

Range

IANA Well-Known (0–1023)

Description

NFS allows remote filesystems to be mounted as if they were local. NFSv4 simplified the port requirements to TCP 2049 only, eliminating the portmapper dependency. AWS EFS, Google Filestore, and Azure Files all expose NFSv4 on port 2049. Production NFS should use NFSv4 with Kerberos authentication (sec=krb5) and be accessible only from authorized client IP ranges via firewall rules.

Security risks

1CVE-2022-43945: Linux kernel NFS buffer overflow in NFSD – specially crafted NFS request causes kernel heap overflow, potentially leading to remote code execution (CVSS 7.5)
2no_root_squash export option: allows remote root user to have root access on the NFS server filesystem – a single compromised client with root gives full server filesystem access
3NFSv3 authentication is IP-based only (no user credentials) – any machine with the right IP address gets full access to exported filesystems
4Data transmitted in cleartext (NFSv3 and NFSv4 without Kerberos) – all file contents, metadata, and operations visible to network sniffers
5World-readable exports: misconfigured /etc/exports with *(rw) allows any host to mount and write to the filesystem

Firewall guidance

NFSv4 needs only TCP 2049 (simplifies firewalling vs NFSv3 which needs 111, 2049, mountd, lockd). Restrict port 2049 to specific client IPs/subnets in both firewall rules AND /etc/exports. Use NFSv4 with Kerberos (sec=krb5p) for authentication and encryption over untrusted networks. AWS EFS: use security groups scoped to VPC CIDR.

Diagnosis commands

List NFS exports from a server (if this works remotely, the server is too open)

shell

showmount -e server_ip

Check NFS export configuration on the server

shell

cat /etc/exports

NFS server statistics – check for errors and rejected operations

shell

nfsstat -s

Mount with NFSv4 + Kerberos encryption (most secure option)

shell

mount -t nfs4 -o sec=krb5p server:/share /mnt

Usage examples

Port 2049 – NFS

shell

mount -t nfs4 server:/export /mnt/nfs
showmount -e server
nfsstat -m

Common services on this port

Linux NFS server (nfs-kernel-server)FreeBSD NFSNetApp ONTAPAWS EFSAzure Files NFSSynology NAS

Related ports

111

rpcbind / portmapper (NFSv3 requires)

2049

NFS (this port)

4045

NFS lock daemon (lockd)

20048

mountd (NFSv3 mount protocol)

History

NFS was created by Sun Microsystems in 1984 as part of their ONC RPC framework. NFSv2 (1989) and NFSv3 (1995) required multiple ports (portmapper, mountd, lockd). NFSv4 (2003, RFC 3530) consolidated everything onto TCP 2049 and added stateful operations. NFSv4.1 (2010) added pNFS for parallel data access. NFSv4.2 (2016) added server-side copy and space reservations. AWS EFS (2016) provides managed NFSv4.1.

FAQ

NFSv3 vs NFSv4 – which should I use?

NFSv4 in all new deployments. Advantages: single port (2049 TCP only, no portmapper), native Kerberos support (sec=krb5p for encryption), stateful protocol (better lock handling), built-in ACL support, firewall-friendly. NFSv3 still needed for: legacy clients, UDP requirement (rare), or when Kerberos infrastructure doesn't exist.

What does root_squash vs no_root_squash mean?

root_squash (default, KEEP IT): maps remote root (uid 0) to nobody/nfsnobody on the server – a compromised client's root cannot modify server files as root. no_root_squash: remote root = server root. Only use no_root_squash when the client MUST write root-owned files (e.g., diskless boot images, container runtime storage) AND the client network is fully trusted.