What uses port 2049
Linux and Unix machines mount remote directories over NFS on port 2049. NFSv4 needs only this one TCP port; NFSv3 also needs the portmapper on 111 and several dynamic ports for mountd, lockd and statd, which makes firewalling harder. AWS EFS and Azure Files NFS shares also use 2049.
Should port 2049 be open to the internet?
Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.
-
NFSv3 trusts the client’s claimed user ID. Restrict exports to specific hosts in
/etc/exports, keeproot_squashon, and use NFSv4 with Kerberos where security matters.
Check what is listening on port 2049
sudo ss -ltnp 'sport = :2049'
sudo ss -lunp 'sport = :2049'sudo lsof -nP -iTCP:2049 -sTCP:LISTEN
sudo lsof -nP -iUDP:2049Get-NetTCPConnection -LocalPort 2049 -State Listen
Get-NetUDPEndpoint -LocalPort 2049
netstat -ano | findstr :2049No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.
Fix “address already in use” on port 2049
Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:
sudo kill $(sudo lsof -t -iTCP:2049 -sTCP:LISTEN)Stop-Process -Id (Get-NetTCPConnection -LocalPort 2049 -State Listen).OwningProcessAllow port 2049 from trusted networks only
The examples allow 2049 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.
sudo ufw allow from 10.0.0.0/8 to any port 2049 proto tcp
sudo ufw allow from 10.0.0.0/8 to any port 2049 proto udp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 2049 proto tcpsudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="2049" protocol="tcp" accept'
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="2049" protocol="udp" accept'
sudo firewall-cmd --reloadNew-NetFirewallRule -DisplayName "NFS 2049/TCP" -Direction Inbound -Protocol TCP -LocalPort 2049 -Action Allow -RemoteAddress 10.0.0.0/8
New-NetFirewallRule -DisplayName "NFS 2049/UDP" -Direction Inbound -Protocol UDP -LocalPort 2049 -Action Allow -RemoteAddress 10.0.0.0/8On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.
Test port 2049 from another machine
nc -zv example.com 2049Test-NetConnection example.com -Port 2049Related ports
- Port 445 (SMB): used by SMB for Windows file and printer sharing.
- Port 873 (rsync): used by the rsync daemon for file synchronization.
More file sharing ports
20 (FTP data) , 21 (FTP) , 69 (TFTP) , 139 (NetBIOS Session) , 990 (FTPS) . See all ports in the port lookup.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What is port 2049 used for?
Port 2049 is used by NFS, the Network File System. Linux and Unix machines mount remote directories over NFS on port 2049. NFSv4 needs only this one TCP port; NFSv3 also needs the portmapper on 111 and several dynamic ports for mountd, lockd and statd, which makes firewalling harder. AWS EFS and Azure Files NFS shares also use 2049.
Is it safe to open port 2049?
Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.
How do I check if port 2049 is open?
On the server, list listening sockets with "sudo ss -ltnp 'sport = :2049'" on Linux or "sudo lsof -nP -i :2049" on macOS. From another machine, run "nc -zv host 2049" or, on Windows, "Test-NetConnection host -Port 2049". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.