TCP Port 2049 – NFS (Network File System)
Port 2049 is the standard port for NFS, the Network File System protocol that Unix and Linux systems use to share files between machines across a network. NFS was developed by Sun Microsystems in the 1980s and became the standard file-sharing mechanism on Unix systems, in much the same way that SMB on port 445 became the standard for Windows. The two protocols solve the same general problem from different starting points: NFS treats remote filesystems as transparent extensions of the local filesystem hierarchy, mounted into specific directories, where SMB exposes them as named shares.
NFS exists in three protocol versions in real-world use. NFSv2 (1989) and NFSv3 (1995) require multiple ports to operate: port 2049 carries the main filesystem operations, but the mountd service that handles initial mounts uses a dynamically assigned port discovered through the portmap service on port 111. NFSv4 (RFC 3530, 2003) was designed to operate over port 2049 alone, eliminating the dependency on portmap and the firewall-traversal problems that came with the multi-port architecture. Modern NFS deployments typically use NFSv4 or its successor NFSv4.1.
NFS is most commonly used in enterprise Unix and Linux environments, university and research computing clusters, and storage-area networks where centralized file servers serve home directories and project data to many client machines. macOS includes an NFS client and can mount NFS shares natively. Windows can mount NFS shares with the optional Services for NFS feature.
Inbound TCP/2049 from the public internet to any host is unusual in 2026 and is widely treated as a serious exposure. Outbound TCP/2049 from end-user devices is normal in mounted-NFS-share workflows and uncommon to internet destinations.
About TCP Port 2049
Port 2049 is registered with the Internet Assigned Numbers Authority (IANA) for nfs. The IANA description reads: ‘Network File System – Sun Microsystems’.
Security Considerations
NFS on port 2049 has historically been one of the more dangerous file-sharing protocols to expose to untrusted networks, primarily because the older versions of the protocol used a trust model based on the client’s claimed identity rather than verified authentication. In NFSv2 and NFSv3, when a client connects to an NFS server and asks to read or write a file, the client tells the server which user is making the request, and the server trusts that claim. Anyone able to send packets to the NFS server can claim to be any user, including root, and access whatever files that user is permitted to access on the exported share.
Our dataset contains no IDS rules referencing port 2049 directly and no curated malware families associated with this port, but this absence is not a strong indicator of low risk. The dominant NFS attack pattern is unauthorized file access by attackers who can reach an exposed NFS server, which most IDS rule sets do not flag rule-by-rule.
NFSv4 substantially improved the situation by introducing real authentication options (including Kerberos via the krb5 security flavor) and by reducing the protocol attack surface to a single port that no longer depends on portmap discovery. However, NFSv4 in the default sec=sys configuration retains the same client-trust model as the older versions, and many real-world deployments use sec=sys for compatibility rather than configuring Kerberos.
Beyond the trust model concerns, NFS exports are commonly misconfigured in ways that allow broader access than intended. The /etc/exports file (or its equivalent on other Unix variants) controls which hosts can mount which exports and with what permissions, and lax export rules (such as exporting to the entire local subnet rather than to specific client IP addresses) are a recurring source of unintended exposure.
Common practice today is to never expose port 2049 to the public internet, restrict NFS to specific internal subnets through firewall rules and tight /etc/exports configurations, and use Kerberos authentication where the operational environment supports it. Where NFSv3 is still in use, ensure that port 111 (portmap) is similarly restricted, since the older NFS protocol depends on it.
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry.