I have a situation where I need to mount a few NFS shares on a series of clients on replicated VM networks. So their source IP addresses are not unique. In between the client and the server there is a routing Linux VM, which can do all sorts of things as deemed appropriate. I'm really unsure how best to approach making these shares reachable.

Possible solutions:

  1. Fully route traffic end to end, with an iptables masquerade on the "router" to Source NAT all client traffic.
  2. Do Masquerading AND Destination NAT on the router, making the internal machines think they are going to the "router" for NFS. This makes routing tables much simpler as everything then appears to be local. Maybe using a secondary IP on the "router" for clarity with all the NFS ports in use.
  3. Mount and then re-export NFS on the "router" VM. This feels really bad, but would give extra control to only allow certain mounts to be mounted by certain clients. As above, any NAT solution means all end clients look to be the same under NFSv3, which could cause security concerns. This also makes the routing tables a non issue. I think I saw comment that performance would significantly drop this way.

Any other options / thoughts gratefully appreciated.

1 Answer 1


I believe NFS clients behind a NAT should work just fine without any special gimmicks. You might have problems if you want to do RPC_GSS (Kerberos authentication), since the server will be checking the client's ip address against its host principal, but if you're just doing AUTH_SYS I don't see any reason why it wouldn't work.

  • I don't doubt any of the solutions would work, it's that I'm looking for the best solution. Ideally I don't want my clients to know anything about the NFS server itself, as this needs to be able to drop into different locations with different subnets on the NFS server side, but always the same on the client. Feb 12, 2011 at 13:57
  • If these are VMs you might mount the filesystems on the hosts and present them up to the guests. Best in what way? It sounds like you want an NFS client to have a static config, but why not just change the server location in DNS? Your original question was ambiguous and I read "how to make them reachable".
    – beans
    Feb 12, 2011 at 14:06
  • our build systems don't fit with additional block device configuration, only a basic OS disk is required, all other inputs need to come over IP. DNS is fine, and if we need to route end to end that would be part of the solution, but our security guys like not having single connections spanning these networks as a first pass. Feb 12, 2011 at 21:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .