Port / TCP/UDP
2049NFS
The Network File System exports directories to Unix and Linux clients over a trusted network.
If it is internet-facing: Finding 2049 open to the internet is a finding in its own right — it warrants an explanation, not just a rule.
Exposure
Trusted network only
Transport
Encryption optional
Risk if public
High
Exposure verdict
Port 2049 belongs on a trusted internal network. If a perimeter scan finds it answering, treat that as a firewall defect rather than a configuration preference.
Encryption is available but negotiated or configured rather than guaranteed. A client that does not insist on it will silently fall back to plaintext.
Registered with IANA on request, but bindable by any unprivileged user. Registration records intent — it does not reserve the port, so collisions between products are common.
Grouped with the other file transfer & shares ports so a rule written for one can be checked against its neighbours.
What actually goes wrong
2 notes- Classic AUTH_SYS trusts the client's claimed UID, so root on any allowed host is root on the export.
- Export lists left as '*' hand the filesystem to anyone who can reach the port.
Recommended firewall rule
Allow only from 10.0.0.0/8, drop the rest
Swap in the CIDR your administrators or application tier actually come from — the point is that the default answer is no.
ufw
sudo ufw allow from 10.0.0.0/8 to any port 2049 proto tcp
sudo ufw allow from 10.0.0.0/8 to any port 2049 proto udpiptables
sudo iptables -A INPUT -p tcp -s 10.0.0.0/8 --dport 2049 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 2049 -j DROP
sudo iptables -A INPUT -p udp -s 10.0.0.0/8 --dport 2049 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 2049 -j DROPIf you do need it open to everyone
sudo ufw allow 2049/tcp
sudo ufw allow 2049/udpWrite down why. An unexplained allow rule outlives the person who added it, and the next reviewer has no way to tell a deliberate exception from an accident.
Check what is really there
Listening locally
sudo ss -tulpn 'sport = :2049'The bind address is the answer that matters: 127.0.0.1 is local-only, 0.0.0.0 and :: mean every interface.
Listening (macOS)
sudo lsof -nP -iTCP:2049 -sTCP:LISTENmacOS ships lsof rather than ss; this names the owning process and user.
From outside
nmap -sSUV -Pn -p 2049 <host>A version probe confirms whether NFS is actually what answers, rather than trusting the number. Only scan hosts you are authorised to test.
Reachability
nc -vz <host> 2049The quick yes/no when you only need to know whether a path exists through the firewall.
The safer path
no port changeChange the configuration, not the port
NFSv4 with Kerberos (krb5p) authenticates and encrypts; without it, restrict by export list and network.
The fix here lives in the service configuration rather than in a different port assignment.