Setting up an NFS server for shared storage on CentOS

An NFS server gives Linux clients a shared view of directories over the network, which suits engineering drawings, project archives and shared home directories. This guide focuses on a small CentOS deployment for teams spread across Australian offices, not internet-facing public file storage.

The examples use CentOS Stream 9, NFSv4.2 and a private client network at 10.20.0.0/16. CentOS 7 reached end of life in June 2024, so Australian organisations still running it should check internal policy and move towards a supported CentOS Stream or RHEL-compatible platform.

Plan the network and storage layout

Decide where the data will live before configuring exports. A single virtual machine in a Sydney or Melbourne data centre may serve users in Melbourne, Brisbane and Perth, but test latency and provider routing first; public internet access is not a substitute for VPN or private connectivity.

Use a dedicated server address and a DNS name such as nfs1.example.com.au. Limit each export to the smallest client subnet that needs it, and document whether users connect from office desktops, remote-access laptops or laboratory systems.

Keep user credentials consistent. NFS normally transfers numeric UID and GID values rather than translating them, so create matching local accounts or map the server’s group through the identity service. Plan separate exports for projects, team files and home directories instead of opening the entire filesystem.

Install NFS and define exports

Install the server package, then enable the systemd service so mounts recover after maintenance or a reboot:

sudo dnf install -y nfs-utils
sudo systemctl enable --now nfs-server

On CentOS 7, replace dnf with yum, although the long-term support implications should be addressed separately.

Create the shared tree and assign the numeric ownership expected by the client systems:

sudo install -d -m 0770 /exports/projects
sudo chown 10001:10001 /exports/projects

The parent directory is exported read-only as the NFSv4 pseudo-root, while the project directory remains writable.

Add the entries to /etc/exports, then reload them:

/exports 10.20.0.0/16(ro,fsid=0,sync,no_subtree_check)
/exports/projects 10.20.0.0/16(rw,fsid=101,sync,no_subtree_check,root_squash)

sudo exportfs -ra

Keep the two fsid values unique. The client path will be /projects, not /exports/projects, because /exports is the NFSv4 root. For a shorter walk-through of a basic configuration, see the simple NFS file share guide.

Protect the service with SELinux and firewalld

Open TCP port 2049 in firewalld for NFSv4, and restrict access to approved network ranges:

sudo firewall-cmd --permanent --add-service=nfs
sudo firewall-cmd --reload

If the estate still uses NFSv3, also allow the required rpcbind and mountd services according to the local design.

On an enforcing CentOS system, label exported paths for NFS:

sudo dnf install -y policycoreutils-python-utils
sudo semanage fcontext -a -t nfs_t '/exports(/.*)?'
sudo restorecon -Rv /exports

Avoid enabling nfsd_export_all_on as a shortcut; contextual labels retain tighter SELinux protection.

Keep root_squash enabled and use explicit rw or ro permissions for each export. Australian organisations handling client data or research should align access reviews, patching and backups with ASD Essential Eight expectations; an NFS server does not replace those controls.

Mount the share on Linux clients

On each client, install the NFS utilities and confirm that DNS resolves the server name:

sudo dnf install -y nfs-utils
getent hosts nfs1.example.com.au

For Australian deployments, use the .com.au hostname shown here consistently in DNS, /etc/hosts during testing and /etc/fstab.

Create the mount point and test it manually before changing the boot configuration:

sudo mkdir -p /mnt/projects
sudo mount -t nfs4 -o vers=4.2 nfs1.example.com.au:/projects /mnt/projects

The nfs4 filesystem and vers=4.2 option keep negotiation on the modern protocol. Older CentOS 7 kernels may require vers=4.1.

Once the test succeeds, add the mount to /etc/fstab:

nfs1.example.com.au:/projects /mnt/projects nfs4 rw,_netdev,vers=4.2,nofail 0 0

The _netdev option prevents boot processes from blocking on remote storage, while nofail allows laptops to remain usable during a WAN outage.

Verify exports with server and client checks

Use server and client diagnostics to separate export, network and permission faults:

sudo exportfs -v
sudo ss -lntp | grep ':2049'

The export state must show the intended client range and options before investigating individual users.

Client verification checklist

findmnt /mnt/projects confirms that the expected NFSv4 source is mounted.
touch /mnt/projects/.write-test verifies write access for the current account.
df -hT /mnt/projects confirms the filesystem type and available capacity.
nfsstat -m displays the negotiated mount and protocol information.

Server verification checklist

sudo exportfs -v lists active exports and their permission options.
sudo ss -lntp | grep ':2049' confirms that the NFS listener is active.
sudo journalctl -u nfs-server -n 100 --no-pager reveals recent service errors.
getenforce and ls -Zd /exports/projects check the SELinux mode and labels.

Treat common errors by layer. A missing path usually means the NFSv4 pseudo-root differs from the configuration; permission denied calls for UID and GID checks; connection refused points to routing, cloud security groups or firewalld. If a client uses a non-standard kernel, verify its NFS modules and filesystem support against the custom kernel build guidance.

Operate the service across Australian teams

Runbook maintenance should cover service logs, capacity, snapshots, the DD/MM/YYYY date format and the relevant AEST or AEDT offset so daylight-saving changes do not distort scheduled jobs. In the Australian technology market, confirm each provider’s CentOS support terms instead of assuming CentOS 7 receives the same fixes as current RHEL-compatible releases.

For a status runbook or internal dashboard, include export state, latency and mount health. A topology graphic built with responsive SVG containers will remain readable on a support engineer’s laptop in Sydney and during a remote session in Perth.

Keep authoritative backups outside the NFS export and test restoration, because replicated filesystems can propagate accidental deletion. The practical takeaway is to begin with one narrow NFSv4 export, an explicit client subnet, stable UID and GID mapping, and a successful client reboot test.