topic Re: nfs mount denied while using vpn tunnel in ONTAP Discussions

nfs mount denied while using vpn tunnel

yb — Wed, 04 Jun 2025 09:50:23 GMT

I'm testing vpn access for our future remote workers. It's mostly done except I cannot mount to the storage.

I checked the packets and confirmed they can communicate each other. But lookup to the storage denied with NFS4ERR_ACCESS error.

I allowed access from IP range of vpn clients in ontap. I cannot guess another reason to be blocked.

Could I check the reason why an access didn't allowed in ontap by commands? Or some hints would be great.

Thanks in advance!

Re: nfs mount denied while using vpn tunnel

Ontapforrum — Tue, 25 Apr 2023 08:51:29 GMT

Firewall : Is the Client allowed outbound traffic to TCP Port 2049 (NFSV4) ? It may be worth checking if this port is open.

Re: nfs mount denied while using vpn tunnel

yb — Tue, 25 Apr 2023 14:27:13 GMT

Hello @Ontapforrum

In this case the client is a mac. (I got a linux pc too, but unfortunately it just broke.)

I found it sends calls via port 61508, but ontap storage replies via 2049. I see they connects well, success to SETCLIENTID, SETCLIENTID_COFIRM call/reply. But lookup for the mount is denied.

Should I be able to send the message through port 2409?

Re: nfs mount denied while using vpn tunnel

Ontapforrum — Tue, 25 Apr 2023 15:35:42 GMT

Mac, interesting. Could you try linux ?

I am wondering if the client OS is supported. Which NFSv4 version is it? 4.0/4.1/4.2?

It may be worth checking which NFS clients ONTAP supports, see the Interoperability Matrix:
https://mysupport.netapp.com/matrix

Also check this blog:
https://whyistheinternetbroken.wordpress.com/2021/04/14/macos-nfs-clients-with-ontap-tips-and-considerations/

Re: nfs mount denied while using vpn tunnel

yb — Mon, 01 May 2023 14:44:21 GMT

We have successfully run mac nfs clients inside of the network. That's the reason I think this is related with vpn.

All of them uses nfs4.0 and krb5i for connection. And setup on my mac isn't different.

Unfortunately, ssd on my linux is broken. I will try soon.

Re: nfs mount denied while using vpn tunnel

Ontapforrum — Mon, 01 May 2023 20:09:14 GMT

Ok. In that case, we can rule out 'mac' as an issue. Have you done pktt (packet) trace on the ONTAP side ?

Also, you could try the following command to check-access to particular client for test purpose:
vserver export-policy check-access command checks whether a specific client is allowed access to a specific export path.
https://docs.netapp.com/us-en/ontap-cli-93/vserver-export-policy-check-access.html#description