Port reference
Port 2049 (TCP) – NFS
Network File System — Unix/Linux protocol for sharing directories over the network.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on hosts running an NFS server with exported shares. Not enabled by default; commonly exposed inside data-center and storage networks.
What is port 2049 used for?
Port 2049 is the standard port for NFS (Network File System), the Unix/Linux protocol for sharing folders over the network and mounting them as if they were local. It's the common way Linux and macOS clients, and NAS devices like Synology and TrueNAS, access shared storage. NFSv4 uses port 2049 on its own, while older NFSv2/v3 also rely on the portmapper on port 111.
When would you open it?
Open 2049 on a server that exports NFS shares to clients on your network — a file server, NAS, or storage host serving home directories or media. Keep it within your trusted LAN; NFS is not meant to be reached across the internet.
Is it safe to open?
Classic NFS trusts the client-supplied user IDs and can expose files to anyone who reaches it, so restrict exports to specific hosts, keep root_squash on, and ideally use NFSv4 with Kerberos. See the security notes below.
How to check if this port is open
ss -tulpn | grep :2049
nmap -p 2049 <target>netstat -ano | findstr :2049
Test-NetConnection <host> -Port 2049lsof -i :2049
nmap -p 2049 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 2049 to your device's local IP, internal port 2049, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 2049/tcpsudo firewall-cmd --permanent --add-port=2049/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 2049 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 2049" -Direction Inbound -Protocol TCP -LocalPort 2049 -Action AllowSecurity & risks
Common attacks
- Export enumeration to discover shared directories
- Unauthenticated file read/write on world-accessible exports
- Privilege escalation via no_root_squash misconfiguration
- UID/GID spoofing to access other users' files (AUTH_SYS)
Hardening
- Never export to * — restrict exports to specific hosts/subnets
- Enable root_squash (avoid no_root_squash) and export read-only where possible
- Use NFSv4 with Kerberos (krb5p) for authentication and encryption
- Do not expose 2049 to the internet — keep it on trusted internal networks
- Audit /etc/exports and showmount output regularly
How to block this port
sudo ufw deny 2049/tcpsudo firewall-cmd --permanent --remove-port=2049/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 2049 -j DROPNew-NetFirewallRule -DisplayName "Block 2049" -Direction Inbound -Protocol TCP -LocalPort 2049 -Action Blocknmap snippet
nmap -p2049 --script nfs-showmount,nfs-ls,nfs-statfs <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is NFS on port 2049 secure?
- Only if hardened. Classic NFS (AUTH_SYS) trusts the client-supplied UID/GID, so an attacker on the network can impersonate any user. Use NFSv4 with Kerberos and tight export rules.
- What is the no_root_squash risk?
- no_root_squash lets a remote root user act as root on the export. An attacker can write a SUID binary or modify files to escalate privileges on the server's data.