EFS access point IP ranges for a specific region in CIDR

Question

I've got a setup that creates an EFS filesystem for each customer individually and mounts it on the resources (ec2 instances) that the customers uses. Unfortunately, EFS uses NFS and NFS requires portmapper - which resulted in an Open Portmapper service vulnerability report on my account. To avoid this risk, I would like to limit access to port 111 to the EFS IP ranges using a security group. Unfortunately, I was not able to find these ranges myself and wonder if they are publicly available. Hence, the question, what are the EFS access point IP ranges in CIDR for eu-central-1?

segrace · Accepted Answer

Hello! EFS is a VPC-bound service and uses *private* IPs from your VPC. When you create an EFS system, the default behavior deploys it with one private IP per Availability Zone in its host VPC. If you don't care which private IPs it chooses from, you can just find the IP addresses it chose by navigating to the "Network" tab of the system's overview page. This private IP is static and will remain the same for the lifetime of the system, so you can simply add explicit Security Group rules for each of those private IPs. If you want to control the IP ranges that the EFS system might choose from:

1. For each Availability Zone you plan on having the EFS system in, define a subnet to house it. (Keep in mind the smallest subnet mask possible is /28, so you must have at minimum 14 available private IPs per AZ to make these subnets).
2. When creating the EFS system, select "Customize" after selecting the "Create file system" button.
3. Progress to the "Network Access" section, then assign each Mount Target to each of the subnets you created in step 1 above. Finish file system creation as you would normally.
4. When configuring your Security Groups, restrict the Port 111 access to the CIDR range(s) of the subnets you placed the Mount Targets in.

Hope this helps out!

Gary Mclean · Answer

* The EFS IP addresses are available on the File System Network Tab.
* In the Console, Goto EFS, Go to the Network Tab and you will see the private IP addresses used.
* You can also use the security group of the EFS filesystem as the target instead of the IP Ranges.

Praveen Muppala · Answer

The recommendations above provide an effective guide for mounting AWS Elastic File System (EFS) Accesspoint using NFS .

However, AWS EFS supports only NFSv4, meaning it exclusively uses Port 2049 and does not rely on Port 111. This distinction, which aligns with NFSv4 standards, allows EFS to operate without the RPC binding required by NFSv3. Consequently, firewall or security group configurations should only open Port 2049 for inbound and outbound traffic. You can learn more in this [AWS re:Post discussion]
(https://repost.aws/questions/QU7hKrJykNTd6G7W2Vth54QA/can-aws-efs-listen-on-a-port-besides-2049-i-e-111). For additional insights into the NFS versions supported by EFS, refer to the [AWS EFS documentation](https://docs.aws.amazon.com/efs/latest/ug/mounting-fs-old.html#mounting-fs-nfs-info).

To mount EFS over NFS, the Portmapper service is unnecessary. Instead, ensure the **EFS Utils** package is installed and specify the EFS filesystem type in your mount command. The exact command for mounting is accessible by navigating to the EFS Access Point and clicking “Attach.”

For more information on EFS Utils installation, visit the [AWS EFS Utils Guide](https://docs.aws.amazon.com/efs/latest/ug/using-amazon-efs-utils.html). For a complete step-by-step guide on mounting via EFS Access Points, check out the [AWS EFS Access Point Mount Steps](https://docs.aws.amazon.com/efs/latest/ug/mounting-access-points.html).

Hope this helps streamline your setup!

EFS access point IP ranges for a specific region in CIDR

Relevant content