1

I am trying to mount my Elastic File System (EFS) on an EC2 instance in the same availability zone. However, mount just hangs and eventually says Connection timed out. The AWS docs say that I must configure my security groups to allow traffic on TCP 2049, the NFS port. However, even when I allow outbound 2049 traffic from the instance, inbound 2049 traffic on the EFS, and my Network ACLs allow inbound/outbound traffic on all ephemeral ports (TCP 1024-65535), I still cannot successfully mount the EFS.

I read on this post that NFS also uses ports TCP/UDP 111 and 1110. If so, why don't the AWS docs mention these ports, and what should my new Security Group / Network ACL rules be?

2

my Network ACLs allow inbound/outbound traffic on all ephemeral ports (TCP 1024-65535)

That's the problem -- these rules are not going to be enough.

The Linux NFS client uses a privileged source port (<1024) for outbound connections by default, instead of an ephemeral port. (See netstat -a -n | grep 2049 while waiting for the timeout.)

Some NFS servers require the client to use a privileged port to originate the connection, but EFS doesn't.

So, add -o noresvport to your mount command and you should have no issue.

Note also that EFS does not require any other open ports -- only TCP 2049 toward the EFS endpoint.

| improve this answer | |
  • Thank you so much! Adding "-o noresvport" fixed it! So are you saying that I should get rid of my ACL rules that allow ephemeral ports? Adding "-o noresvport" works even with these rules set, and according to the docs, I needs these rules to allow SSH access and HTTPS traffic. – Rabadash8820 Sep 15 '16 at 16:27
  • Also, I'm now getting the error "special device us-east-1a.fs-1768925e.efs.us-east-1.amazonaws.com:/ does not exist" even though I've verified that this is the correct DNS for the EFS mount target. Any ideas on this? – Rabadash8820 Sep 15 '16 at 16:43
  • I'm not saying block the ephemeral ports. I updated the answer to try to clarify that. Adding -o noresvport tells the client to use an ephemeral port. – Michael - sqlbot Sep 15 '16 at 19:31
  • Wait... I thought you said this was fixed, but now you say you get an error? What changed? Show your entire mount command. – Michael - sqlbot Sep 15 '16 at 19:32
  • OK, the edited answer makes more sense, thanks again for your time on this. The "does not exist" error is actually happening when I try to modify /etc/fstab and mount automatically. Mounting manually works fine. My mount command was "sudo mount -t nfs -o vers=4.1,noresvport us-east-1a.fs-1768925e.efs.us-east-1.amazonaws.com:/ myDir", and again it works without issue (verified by checking /etc/mtab). The line that I'm adding to the fstab is "us-east-1a.fs-1768925e.efs.us-east-1.amazonaws.com:/ myDir xfs defaults,vers=4.1,noresvport 0 0" and then I run "sudo mount -a -t nfs", giving the error – Rabadash8820 Sep 16 '16 at 4:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.