I haven't found a slam-dunk document on this, so let's start one.On a CentOS 7.1 host, I have gone through the linuxconfig HOW-TO, including the firewall-cmd entries, and I have an exportable filesystem.[root@<server> ~]# firewall-cmd --list-allinternal (default, active)  interfaces: enp5s0  sources: 192.168.10.0/24  services: dhcpv6-client ipp-client mdns ssh  ports: 2049/tcp  masquerade: no  forward-ports:   rich rules: [root@<server> ~]# showmount -e localhostExport list for localhost:/export/home/<user> *.localdomainHowever, if I showmount from the client, I still have a problem.[root@<client> ~]# showmount -e <server>.localdomainclnt_create: RPC: Port mapper failure - Unable to receive: errno 113 (No route to host)Now, how am I sure that this is a firewall problem? Easy. Turn off the firewall. Server side:[root@<server> ~]# systemctl stop firewalldAnd client side:[root@<client> ~]# showmount -e <server>.localdomainExport list for <server>.localdomain:/export/home/<server> *.localdomainRestart firewalld. Server side:[root@<server> ~]# systemctl start firewalldAnd client side:[root@<client> ~]# showmount -e <server>.localdomainclnt_create: RPC: Port mapper failure - Unable to receive: errno 113 (No route to host)So, let's go to town, by adapting the iptables commands from a RHEL 6 NFS server HOW-TO...[root@ ~]# firewall-cmd \>  --add-port=111/tcp \>  --add-port=111/udp \>  --add-port=892/tcp \>  --add-port=892/udp \>  --add-port=875/tcp \>  --add-port=875/udp \>  --add-port=662/tcp \>  --add-port=662/udp \>  --add-port=32769/udp \>  --add-port=32803/tcpsuccess[root@<server> ~]# firewall-cmd \>  --add-port=111/tcp \>  --add-port=111/udp \>  --add-port=892/tcp \>  --add-port=892/udp \>  --add-port=875/tcp \>  --add-port=875/udp \>  --add-port=662/tcp \>  --add-port=662/udp \>  --add-port=32769/udp \>  --add-port=32803/tcp \>  --permanentsuccess[root@<server> ~]# firewall-cmd --list-allinternal (default, active)  interfaces: enp5s0  sources: 192.168.0.0/24  services: dhcpv6-client ipp-client mdns ssh  ports: 32803/tcp 662/udp 662/tcp 111/udp 875/udp 32769/udp 875/tcp 892/udp 2049/tcp 892/tcp 111/tcp  masquerade: no  forward-ports:   rich rules: This time, I get a slightly different error message from the client:[root@<client> ~]# showmount -e <server>.localdomainrpc mount export: RPC: Unable to receive; errno = No route to hostSo, I know I'm on the right track. Having said that, why can't I find a definitive tutorial on this anywhere? I can't have been the first person to have to figure this out!What firewall-cmd entries am I missing?Oh, one other note. My /etc/sysconfig/nfs files on the CentOS 6 client and the CentOS 7 server are unmodified, so far. I would prefer to not have to change (and maintain!) them, if at all possible.
NFS servers and firewalld
centos;rhel;nfs;firewalld;file server
This should be enough:firewall-cmd --permanent --add-service=nfsfirewall-cmd --permanent --add-service=mountdfirewall-cmd --permanent --add-service=rpc-bindfirewall-cmd --reload