Install the NFS kernel server package (or nfs-user-server if you prefer):

aptitude install nfs-kernel-server

In /etc/hosts.deny, deny access to all comers:

mountd: ALL
statd: ALL
portmap: ALL
rquotad: ALL

Then in /etc/hosts.allow, let the good guys through (adjust for your network):

mountd: 192.168.1.1 192.168.1.2
statd: 192.168.1.1 192.168.1.2
portmap: 192.168.1.1 192.168.1.2
rquotad: 192.168.1.1 192.168.1.2
ypserv: 192.168.1.1 192.168.1.2

We need to configure static port numbers for the various services by editing their respective init-scripts in /etc/default:

/etc/default/nfs-common

STATDOPTS="--port 32765 --outgoing-port 32766"

/etc/default/nfs-kernel-server

RPCMOUNTDOPTS="-p 32767"

/etc/default/quota

RPCRQUOTADOPTS="-p 32769"

The nfs daemon (rpc.nfsd or just nfsd) will listen on port 2049 by default if no port is specified.

Update /etc/services:

# NFS ports as per the NFS-HOWTO
# http://www.tldp.org/HOWTO/NFS-HOWTO/security.html#FIREWALLS
# Listing here does not mean they will bind to these ports. 
rpc.nfsd        2049/tcp                        # RPC nfsd
rpc.nfsd        2049/udp                        # RPC nfsd
rpc.statd-bc    32765/tcp                       # RPC statd broadcast
rpc.statd-bc    32765/udp                       # RPC statd broadcast
rpc.statd       32766/tcp                       # RPC statd listen
rpc.statd       32766/udp                       # RPC statd listen
rpc.mountd      32767/tcp                       # RPC mountd
rpc.mountd      32767/udp                       # RPC mountd
rcp.lockd       32768/tcp                       # RPC lockd/nlockmgr
rcp.lockd       32768/udp                       # RPC lockd/nlockmgr
rpc.quotad      32769/tcp                       # RPC quotad
rpc.quotad      32769/udp                       # RPC quotad

I created /etc/modprobe.d/options.local to provide the lockd module with options.

# /etc/modprobe.d/options.local
options lockd nlm_udpport=32768 nlm_tcpport=32768

An example of allowing a firewall server make nfs mounts to an internal server.

This rule set for the shorewall firewall allows traffic for portmap (111), nfs (2049).

###########################################################
# NFS SERVER                                              #
###########################################################
ACCEPT          net:192.168.1.1       $FW     udp     111
ACCEPT          net:192.168.1.2       $FW     tcp     111
ACCEPT          net:192.168.1.1       $FW     udp     2049
ACCEPT          net:192.168.1.2       $FW     tcp     2049
ACCEPT          net:192.168.1.1       $FW     udp     32765:32769
ACCEPT          net:192.168.1.2       $FW     tcp     32765:32769
ACCEPT          net:192.168.1.1       $FW     udp     111
ACCEPT          net:192.168.1.2       $FW     tcp     111
ACCEPT          net:192.168.1.1       $FW     udp     2049
ACCEPT          net:192.168.1.2       $FW     tcp     2049
ACCEPT          net:192.168.1.1       $FW     udp     32765:32769
ACCEPT          net:192.168.1.2       $FW     tcp     32765:32769

Set-up some exports in /etc/exports:

/home        192.168.1.1(rw,sync) 192.168.1.2(rw,sync)

Install the nfs-client packages and portmap:

aptitude install nfs-common portmap

Configure portmap to use a specific port:

# /etc/default/nfs-common

STATDOPTS="--port 32765 --outgoing-port 32766"

In /etc/hosts.deny, deny access:

mountd: ALL
statd: ALL
portmap: ALL
rquotad: ALL

Then in /etc/hosts.allow, let the good guys through (adjust for your network):

mountd: 192.168.1.1 192.168.1.2
statd: 192.168.1.1 192.168.1.2
portmap: 192.168.1.1 192.168.1.2
rquotad: 192.168.1.1 192.168.1.2
ypserv: 192.168.1.1 192.168.1.2

Configure the firewall on the client to allow incoming connections to portmap as shown below:

###########################################################
# PORTMAP                                                 #
###########################################################
ACCEPT          net:192.168.1.1       $FW     udp     111
ACCEPT          net:192.168.1.2       $FW     tcp     111
ACCEPT          net:192.168.1.1       $FW     udp     32765:32769
ACCEPT          net:192.168.1.2       $FW     tcp     32765:32769
ACCEPT          net:192.168.1.1       $FW     udp     111
ACCEPT          net:192.168.1.2       $FW     tcp     111
ACCEPT          net:192.168.1.1       $FW     udp     32765:32769
ACCEPT          net:192.168.1.2       $FW     tcp     32765:32769

Manually test mounting an nfs export:

mount 192.168.1.1:/home /home

To automatically mount on boot add the export to /etc/fstab:

192.168.1.1:/home /home nfs rw,rsize=8192,wsize=8192,hard,intr,udp,noatime 0 0