Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a machine acting as a KVM host and another machine that NFS exports to that KVM host. I'd like for one of the internal VMs on the KVM host to be able to mount the NFS share. I can export to the KVM host IP fine and do a mount, but it doesn't work for the internal VM; I just get a failed error with "reason given by server: Permission denied".

I've already tried to re-export the NFS from host to VM, but apparently doing two levels of NFS is not a Good Idea. Anyone know how I might get this working?

share|improve this question
up vote 1 down vote accepted

How is networking setup for your VM? Is it bridged, meaning the VM has an IP directly reachable from your network? Or is it behind NAT, which is what libvirt does by default? If it is NAT, your export line should look like

<directory><IP of the KVM Host>(rw,no_root_squash,insecure)

The first change is that, instead of allowing access from the virtual machine's IP, you allow access from the IP of the physical machine hosting the virtual machine. This is necessary because with NAT the IP addresses of your virtual machines are translated to the IP address of the KVM host. The second change is adding the insecure option, which is necessary for your NFS server to accept connections from a port number higher than 1024. This is necessary because when the KVM host does NAT it will use a port higher than 1024 for the connection.

share|improve this answer
sciurus, thanks so much! That was precisely the problem. Put insecure in and everything worked out. Hooray! – jbfink Feb 28 '11 at 17:04

What are the export options on the NFS server? Is your VM IP allowed to access the NFS volume or did you restrict access to the specific IP of the host?

Oh, and yes: Resharing an NFS mount is a bad idea.

share|improve this answer
Here's what the export line looks like: <directory><IP name of internal VM>(rw,no_root_squash). – jbfink Feb 14 '11 at 15:27
Although I notice that when I do showmount -e on the internal VM, the canonical DNS name of the KVM host shows up. – jbfink Feb 14 '11 at 15:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.