Unable to mount NFSv4 over tailscale

Operating Systems & Open Source BSD
, ,
1

Hi,
I have a pfsense added to my tailscale. It has subnet routing and exit node setting on it, and under it is a truenas NFS share. When I connect to tailnet, I can ping truenas using subnet ip, I can login to truenas management UI using subnet ip, but I cannot mount NFS share using subnet ip. What could be the issue?
In tailscal docs, it says only tcp, udp, icmp echo works in user mode. This is how tailscale works on bsd. Don’t know if it is the culprit.

Here are some output I gathered.

doas mount -t nfs4 -o nfsvers=4 192.168.10.11:/mnt/share /mnt
mount.nfs: No such device for (null) on /mnt

doas[33500]: jeff ran command mount -t nfs 192.168.10.11:/mnt/share/ /mnt/ as root from /home/jeff
systemd[1]: Mounting /mnt...
mount[33502]: mount.nfs: Operation not permitted for 192.168.10.11:/mnt/share on /mnt
systemd[1]: mnt.mount: Mount process exited, code=exited, status=32/n/a
systemd[1]: mnt.mount: Failed with result 'exit-code'.
systemd[1]: Failed to mount /mnt.
systemd[1]: mnt.automount: Got automount request for /mnt, triggered by 33523 (mount.nfs)
systemd[1]: Mounting /mnt...
mount[33527]: mount.nfs: Operation not permitted for 192.168.10.11:/mnt/share on /mnt
systemd[1]: mnt.mount: Mount process exited, code=exited, status=32/n/a
systemd[1]: mnt.mount: Failed with result 'exit-code'.
systemd[1]: Failed to mount /mnt.
systemd[1]: mnt.automount: Got automount request for /mnt, triggered by 33523 (mount.nfs)
systemd[1]: Mounting /mnt...
mount[33544]: mount.nfs: Operation not permitted for 192.168.10.11:/mnt/share on /mnt
systemd[1]: mnt.mount: Mount process exited, code=exited, status=32/n/a
systemd[1]: mnt.mount: Failed with result 'exit-code'.
systemd[1]: Failed to mount /mnt.
doas[33498]: pam_unix(doas:session): session closed for user root
2

This is the critical piece of info.

Your nfs server doesn’t permit connections from your tailscale IP. Add it to the share in /etc/exports.

3 Likes
3

I did add private subnet and tailscale ip, but still unable to mount.

4

Sorry, I have not been very clear. Just modifying /etc/exports will not enable the change.
Restarting nfs after updating /etc/exports should do.
You can query what shares are exported and their IP restrictions using showmount -e <nfs server ip address> .

3 Likes
5

I have a similar issue with NFSv4 over tailscale on FreeBSD. It kinda works, but with sporadic hangs for a minute or so. On the server I see this constantly logged to dmesg:

Nov 20 21:18:37 master kernel: nfsrv_cache_session: no session IPaddr=100.64.180.99, check NFS clients for unique /etc/hostid’s
Nov 20 21:18:38 master kernel: nfsrv_cache_session: no session IPaddr=100.64.233.123, check NFS clients for unique /etc/hostid’s
Nov 20 21:18:39 master kernel: nfsrv_cache_session: no session IPaddr=100.64.174.227, check NFS clients for unique /etc/hostid’s
Nov 20 21:18:39 master kernel: nfsrv_cache_session: no session IPaddr=100.64.194.39, check NFS clients for unique /etc/hostid’s
Nov 20 21:18:39 master kernel: nfsrv_cache_session: no session IPaddr=100.64.211.195, check NFS clients for unique /etc/hostid’s
Nov 20 21:18:39 master kernel: nfsrv_cache_session: no session IPaddr=100.64.195.145, check NFS clients for unique /etc/hostid’s
Nov 20 21:18:41 master kernel: nfsrv_cache_session: no session IPaddr=100.64.108.178, check NFS clients for unique /etc/hostid’s

(all hostids are unique)

on clients I see this constantly logged to dmesg:
Initiate recovery. If server has not rebooted, check NFS clients for unique /etc/hostid’s

No idea what is going on and how to debug it.