Error: mount.nfs: Operation not permitted (rc=32) when mounting NFS v3 storage in VKS/TKG environments using NSX VPC NAT

Products

• VMware NSX

Issue/Introduction

When attempting to mount a Persistent Volume (PV) or Virtual Machine (VM) backed by an NSX VPC or L2 Segment to an NFS v3 shared storage solution (e.g., HP Alletra), the mount fails. The following error is observed in Kubernetes events or system logs: 

 

mount failed with rc=32 err=mount.nfs: Operation not permitted mount.nfs: access denied by server while mounting :/file-path-of-share

Environment

• VMware Cloud Foundation (VCF) 9.x
• VMware vSphere Kubernetes Service (VKS)
• NSX

Cause

NFS v3 requires a TCP source port in the privileged range (1-1024) for the initial mount request. By default, NSX Gateways (Tier-0 or Tier-1) performing Source NAT (SNAT) create stateful sessions that translate the source port to an unprivileged range (20,000–65,000). The storage array identifies these unprivileged ports as "insecure" and rejects the connection.

Resolution

Workaround:

Choose one of the following methods to resolve the mount failure:

1. Configure Reflexive NAT: Replace the stateful SNAT rule with a Reflexive NAT (stateless) rule on the NSX VPC or Tier-1 Gateway. Reflexive NAT preserves the original privileged source port during address translation.
2. Modify Storage Permissions: Configure the NFS export on the storage array (e.g., HP Alletra) to permit "insecure" ports (source ports > 1024). This is typically done by adding the insecure flag to the export options for the specific NAT IP addresses.