External NFS Server Configuration

External NFS Server Configuration

The platform can share data between a storage server and clients inside or outside the platform. When the NFS client is external, configure the storage server manually: attach a public IP, define exports, restrict client access, apply the export settings, open the required NFS ports, and align file permissions.
On this page

Sharing Model

When both storage and client are inside the same platform account, the platform can automate part of the export or mount workflow. When one side is external, the NFS server must explicitly export the required directory and the external client must mount it.

The procedure below uses a platform Shared Storage Container as the NFS server, but the same general approach applies to other NFS-based storage servers.

1. Attach a Public IP

To share NFS data over the Internet, attach a public IP address to the storage server.

Shared Storage Container with public IP
Attach a public IP to the Shared Storage Container before exposing NFS to an external client.

2. Configure /etc/exports

Declare each directory that should be shared in the server’s /etc/exports file. In the platform dashboard, open the built-in Configuration File Manager and use the Exports section.

{directory} {NFS_client}([option],[option],...)
{directory} Path to the directory that should be exported.
{NFS_client} Custom domain name or public IP address of the external client that will mount the exported files.
NFS exports configuration file
Define the exported path, permitted client, and NFS options in the exports configuration.

If the external client does not have its own public address, the source describes obtaining its hosting-node IP with:

curl ifconfig.co
Get external host IP
Retrieve the host IP from the client container when no direct external address is attached.
Security warning: Using the underlying host IP is highly insecure for production because it can make the exported data reachable by other containers on the same host. Prefer a dedicated client public IP or another properly isolated network path.

NFS Export Options

  • async — can improve performance by acknowledging writes before data is fully committed to storage, but introduces some risk of data loss if the server fails while cached writes remain unwritten.
  • ro / rw — grants read-only or read/write access to the client.
  • no_root_squash — allows the client-side root user to retain root-level permissions on the exported data.
  • no_subtree_check — disables subtree checking for the exported directory, which can improve performance but reduces the ability to apply different rules below that directory.
For additional NFS access control, the source recommends using /etc/hosts.allow and /etc/hosts.deny where appropriate.

3. GlusterFS Storage Requirements

For Shared Storage Auto-Cluster based on GlusterFS, only the /data directory is replicated between storage instances. Therefore, any directory exported from the cluster should be located under /data.

The export definition must also include an fsid value. Generate a random identifier with:

cat /proc/sys/kernel/random/uuid
Generate random NFS fsid
Generate a unique fsid value for the GlusterFS-backed export.
GlusterFS NFS export configuration
Add the fsid option to the export definition for Shared Storage Auto-Cluster.

Save the exports configuration after making the required changes.

4. Apply Export Settings

Reload the NFS export table so the new configuration becomes active:

exportfs -ra
Apply new NFS export settings
Reload the NFS exports after editing the configuration.

5. Open Required Firewall Ports

Allow the external NFS client to reach the storage server on ports 111, 2049, and 20048. You can add these rules through Settings > Firewall.

Configure NFS firewall rules through UI
Create inbound firewall rules for the NFS ports and restrict them to the client IP.

The source also provides equivalent command-line rules:

iptables -I INPUT -p tcp -m multiport --dports 111,2049,20048 -s {NFS_client} -j ACCEPT
iptables -I INPUT -p udp -m multiport --dports 111,2049,20048 -s {NFS_client} -j ACCEPT
Configure NFS iptables rules
Allow TCP and UDP NFS traffic from the specific external client address.
Firewall rule: Do not expose NFS ports to all Internet addresses. Restrict access to the known client IP whenever possible.

6. Align Folder Permissions

For read/write exports, make sure the same application users have compatible permissions on both the NFS client and server. Different stack types may run under different default users.

If necessary, adjust ownership on the storage server:

chown {uid}:{gid} {path}
  • {uid} — user name or numeric user ID; check /etc/passwd.
  • {gid} — group name or numeric group ID; check /etc/group.
  • {path} — directory whose ownership should be changed.
Change NFS folder ownership
Align folder ownership with the user and group expected by the external NFS client.
External NFS configuration summary: attach a public IP, define the export and permitted client in /etc/exports, add an fsid for GlusterFS-backed storage, run exportfs -ra, open ports 111/2049/20048 only for the client, and align file ownership before mounting the share on the external server.

What’s next?