NFS: sharing files across Linux machines

NFS (Network File System) lets you share directories between Linux machines over the network. It’s been around since the 1980s and it’s still the simplest way to share files between Linux servers in the same network.

Server setup

Install the NFS server:

sudo apt install nfs-kernel-server

Create or choose the directory to share:

sudo mkdir -p /srv/nfs/shared
sudo chown nobody:nogroup /srv/nfs/shared

Configure exports in /etc/exports:

/srv/nfs/shared 192.168.1.0/24(rw,sync,no_subtree_check)

This shares /srv/nfs/shared with all machines on the 192.168.1.0/24 subnet.

Export options:

• rw — read-write (use ro for read-only)
• sync — write data to disk before replying (safer but slower)
• no_subtree_check — improves reliability (recommended)
• root_squash — maps root on the client to nobody on the server (default, keep this)
• no_root_squash — allows root on the client to be root on the share (dangerous)

Apply the exports:

sudo exportfs -ra

Start the server:

sudo systemctl enable nfs-kernel-server
sudo systemctl start nfs-kernel-server

Client setup

Install the NFS client:

sudo apt install nfs-common

Show available shares on a server:

showmount -e nfs-server-ip

Mount a share:

sudo mount -t nfs nfs-server-ip:/srv/nfs/shared /mnt/shared

Make it permanent in /etc/fstab:

nfs-server-ip:/srv/nfs/shared /mnt/shared nfs defaults 0 0

Firewall configuration

NFS uses several ports. For simplicity, allow the NFS server ports:

sudo ufw allow from 192.168.1.0/24 to any port nfs

Or if using iptables directly, NFS needs ports 2049 (nfs), 111 (rpcbind), and potentially others depending on your NFS version.

For fixed ports, configure /etc/default/nfs-kernel-server and /etc/default/nfs-common to lock down the port numbers.

Performance tuning

Mount options for better performance:

nfs-server:/share /mnt nfs rw,hard,intr,rsize=32768,wsize=32768 0 0

• hard — retry indefinitely if the server is unavailable (recommended for critical data)
• soft — return error after timeout (can cause data corruption)
• intr — allow interruption of hung NFS operations
• rsize/wsize — read/write block sizes (larger = better throughput on fast networks)

For NFSv4, which is the modern version:

nfs-server:/share /mnt nfs4 rw,hard,intr 0 0

NFSv4 is simpler to firewall (uses only port 2049) and has better security options.

Troubleshooting

Check if the NFS server is running:

sudo systemctl status nfs-kernel-server
rpcinfo -p nfs-server-ip

Check what’s exported:

sudo exportfs -v

Debug mount issues:

sudo mount -v -t nfs nfs-server-ip:/srv/nfs/shared /mnt/shared

Check NFS statistics:

nfsstat -s    # server stats
nfsstat -c    # client stats

Stale file handles happen when a file is deleted on the server while a client has it open. Fix by unmounting and remounting the client.

Security considerations

Use root_squash (the default) so root on clients doesn’t mean root on the server.

Restrict exports to specific IP ranges, not * (everyone).

For sensitive data, use NFSv4 with Kerberos authentication (sec=krb5).

Use network segmentation — NFS traffic shouldn’t leave your internal network.

Common mistakes

Using no_root_squash. This lets root on any client be root on the NFS share. Only use this if you fully trust every client.

Forgetting to exportfs after editing /etc/exports. Changes don’t take effect until you run exportfs -ra.

Using soft mounts for important data. Soft mounts can cause data corruption if the server is temporarily unavailable. Use hard for anything that matters.

Not checking firewall rules. NFS uses multiple ports. If you only open 2049, things might partially work and be very confusing.

Remarks

NFS is the straightforward way to share files between Linux machines. Set up the server, configure exports, mount on the clients. Keep it simple: use NFSv4, use root_squash, restrict to your internal subnet. For most internal file sharing needs, NFS is the right tool.