Troubleshooting Amazon EFS NFS I/O Hang: Its Relationship with Security Group Outbound Rules

Amazon EFS may swap backend servers during internal maintenance, and at this time the new server sends a TCP RST to the client to trigger a reconnection.

The problem occurs in environments where the default Outbound Allow All has been removed from the mount target's Security Group. An RST without ACK may not be subject to stateful auto-allow and can be blocked, and as a result the client fails to recognize the connection termination and keeps sending requests over the existing session, causing NFS I/O to hang for 1-2 minutes.

The symptom recurred dozens of times a day after maintenance, and the kernel log left the message server not responding, still trying. Amazon VPC Flow Logs showed no REJECT, and a definitive diagnosis required tcpdump on the EC2 client.

The capture results clearly diverged between the normal and problematic environments.

• Normal: immediately after receiving the new server's [RST], the client establishes a new TCP connection right away
• Problematic: no [RST] is seen, only repeated retransmissions, with recovery only after about 46 seconds

noresvport and the EFS mount helper improve reconnection stability, but they do not solve the problem of the RST itself being blocked. Therefore, the solution is to add an All TCP(0-65535) Outbound rule to the mount target's security group, targeting the EC2 instance's security group. Allowing only NFS 2049 is not sufficient.