Exporting NFS shares from a Linux server: /etc/exports, exportfs and NFSv4-only mode

Goal

Share one or more directories from a Linux server over NFS, control who may mount them, and confirm the server offers NFSv4 only when that is what you want.

Prerequisites

nfs-utils (or the distribution's NFS server package) installed, root access, the directory to export already present, and a firewall you can adjust afterwards.

Steps

1. Add one line per share to /etc/exports: the directory, then one or more client specifications, each followed directly by its options in parentheses, for example: /srv/data 10.0.0.0/24(rw,sync,no_subtree_check) Do not put a space between client and (: /srv/data 10.0.0.0/24 (rw) exports read-write to every host. exports(5) documents each option: rw allows both read and write requests, where the default is read-only. In nfs-utils releases after 1.0.0, sync is the default, and since 1.1.0 so is no_subtree_check; writing both documents intent. secure (requests from ports below 1024) is also the default; add insecure only for clients that need it.
2. Reload the export table without restarting the server: exportfs -ra (as root) reexports all directories, synchronising /var/lib/nfs/etab with /etc/exports and any files under /etc/exports.d, and drops exports that were removed from them.
3. Check what is actually exported: exportfs -v is verbose, showing the full option set for every current export, including options that were not written literally because they are defaults.
4. To offer NFSv4 only, edit /etc/nfs.conf's [nfsd] section: set vers3 = n, vers4 = y (and typically udp = n). nfs.conf(5) states these version and protocol values are Booleans that rpc.mountd also reads.
5. Restart the server daemon for nfs.conf changes to take effect (systemctl restart nfs-server on most distributions); exportfs -ra alone rereads /etc/exports, not /etc/nfs.conf.
6. Open the firewall: an NFSv4-only server needs only TCP 2049 to the server, since NFSv4 clients do not use rpcbind (111), mountd or statd. rpcbind and rpc-statd can then optionally be stopped and masked on systemd distributions, but keep rpc.mountd (or nfsv4.exportd on newer nfs-utils) running: the kernel still asks it locally for export decisions.

Expected result

exportfs -v shows the intended directories and options; mounting with -o vers=4.2 (or 4.1) from an allowed client succeeds while other networks are refused. On an NFSv4-only server showmount -e fails by design, because it uses the MOUNT protocol via rpcbind; test with a real mount instead.

Limits and test basis

Disabling NFSv3 breaks any client still mounting with vers=3 or relying on the separate mountd/statd ports; check current client mounts first. Restarting nfs-server briefly interrupts in-flight I/O for existing clients — schedule it, or change only /etc/exports (via exportfs -ra, no restart needed) when just the client list changes. Back up /etc/exports before editing it.