6.5.1

Table Of Contents
Supported services, including NFS, are described in a rule set configuration file in the ESXi firewall
directory /etc/vmware/firewall/. The file contains firewall rules and their relationships with ports and
protocols.
The behavior of the NFS Client rule set (nfsClient) is different from other rule sets.
For more information about firewall configurations, see the vSphere Security documentation.
NFS Client Firewall Behavior
The NFS Client firewall rule set behaves differently than other ESXi firewall rule sets. ESXi configures
NFS Client settings when you mount or unmount an NFS datastore. The behavior differs for different
versions of NFS.
When you add, mount, or unmount an NFS datastore, the resulting behavior depends on the version of
NFS.
NFS v3 Firewall Behavior
When you add or mount an NFS v3 datastore, ESXi checks the state of the NFS Client (nfsClient)
firewall rule set.
n
If the nfsClient rule set is disabled, ESXi enables the rule set and disables the Allow All IP
Addresses policy by setting the allowedAll flag to FALSE. The IP address of the NFS server is
added to the allowed list of outgoing IP addresses.
n
If the nfsClient rule set is enabled, the state of the rule set and the allowed IP address policy are
not changed. The IP address of the NFS server is added to the allowed list of outgoing IP addresses.
Note If you manually enable the nfsClient rule set or manually set the Allow All IP Addresses policy,
either before or after you add an NFS v3 datastore to the system, your settings are overridden when the
last NFS v3 datastore is unmounted. The nfsClient rule set is disabled when all NFS v3 datastores are
unmounted.
When you remove or unmount an NFS v3 datastore, ESXi performs one of the following actions.
n
If none of the remaining NFS v3 datastores are mounted from the server of the datastore being
unmounted, ESXi removes the server's IP address from the list of outgoing IP addresses.
n
If no mounted NFS v3 datastores remain after the unmount operation, ESXi disables the nfsClient
firewall rule set.
NFS v4.1 Firewall Behavior
When you mount the first NFS v4.1 datastore, ESXi enables the nfs41client rule set and sets its
allowedAll flag to TRUE. This action opens port 2049 for all IP addresses. Unmounting an NFS v4.1
datastore does not affect the firewall state. That is, the first NFS v4.1 mount opens port 2049 and that port
remains enabled unless you close it explicitly.
vSphere Storage
VMware, Inc. 171