Port 2049 (NFS)

Network File System; NFSv4 needs only 2049, while NFSv3 also needs rpcbind (111) and mountd.

Registered (user) port, 1024-49151 TCPUDP File transfer and storage Do not expose to the internet

What port 2049 is used for

Network File System; NFSv4 needs only 2049, while NFSv3 also needs rpcbind (111) and mountd.

Security: should port 2049 be open?

Do not expose to the internet. Never expose NFS. Exports authenticate by client IP and UID by default (AUTH_SYS), so anyone who can reach them can often read files. Restrict exports in /etc/exports and firewall the port.

IANA assignment

Service nameProtoDescriptionAssigneeReference

nfs TCP Network File System - Sun Microsystems
Defined TXT keys: path=<path to mount point> Brent Callaghan -

nfs UDP Network File System - Sun Microsystems
Defined TXT keys: path=<path to mount point> Brent Callaghan -

nfs SCTP Network File System
Defined TXT keys: path=<path to mount point> - RFC 5665

Check what is listening on port 2049

Linux: is anything listening on TCP 2049?

sudo ss -tlnp 'sport = :2049'

Linux: UDP 2049

sudo ss -ulnp 'sport = :2049'

Linux / macOS: which process owns the port

sudo lsof -nP -i :2049

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':2049 '

Windows (Command Prompt)

netstat -ano | findstr :2049

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 2049 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 2049

From Windows

Test-NetConnection HOST -Port 2049

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 2049

Block port 2049 in the firewall

ufw

sudo ufw deny 2049/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 2049 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 2049 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 2049' -Direction Inbound -Protocol TCP -LocalPort 2049 -Action Block

ufw

sudo ufw deny 2049/udp