What iptables rules are needed to allow an nfs share on 16.04?

Question

Can anyone provide the exact wording/coding I would have to add to my /etc/iptables/rules.v4 file ? The server I am working on has many complicated firewall rules, and I have determined it is for sure the iptables preventing the nfs mount as I can mount if the iptables are down. My NFS version is 4. As I understand ports 111 and 2049 need to allow traffic, but I feel I am not typing the rules correctly. The share is over a private network. The NFS share's IP is 172.16.10.25, and the private IP of the 16.04 server is 172.16.10.20.

NOTE: There are several filters in place so any advice on where exactly to place the rules is much appreciated.

I have tried these two seperate answers found on the net will no joy.

# Portmap ports
-A INPUT -m state –state NEW -p tcp –dport 111 -j ACCEPT    
-A INPUT -m state –state NEW -p udp –dport 111 -j ACCEPT    
# NFS daemon ports    
-A INPUT -m state –state NEW -p tcp –dport 2049 -j ACCEPT    
-A INPUT -m state –state NEW -p udp –dport 2049 -j ACCEPT    

The other is

 iptables -P INPUT DROP    
   iptables -P OUTPUT DROP    
   iptables -A INPUT -s 192.168.1.0/24 -d 192.168.1.0/24 -p udp -m multiport --sports 10053,111,2049,32769,875,892 -m state --state ESTABLISHED -j ACCEPT 
   iptables -A INPUT -s 192.168.1.0/24 -d 192.168.1.0/24 -p tcp -m multiport --sports 10053,111,2049,32803,875,892 -m state --state ESTABLISHED -j ACCEPT 
   iptables -A OUTPUT -s 192.168.1.0/24 -d 192.168.1.0/24 -p udp -m multiport --dports 10053,111,2049,32769,875,892 -m state --state NEW,ESTABLISHED -j ACCEPT 
   iptables -A OUTPUT -s 192.168.1.0/24 -d 192.168.1.0/24 -p tcp -m multiport --dports 10053,111,2049,32803,875,892 -m state --state NEW,ESTABLISHED -j ACCEPT 
   iptables -I INPUT  -i lo -d 127.0.0.1 -j ACCEPT
   iptables -I OUTPUT  -o lo -s 127.0.0.1 -j ACCEPT
   iptables -L -n --line-numbers    

Using my own IP instead of what is in the above example.

Solution

Here is what worked for me for future askers.

-A INPUT -s 172.16.10.25/32 -d 172.16.10.40/32 -i eth0 -p tcp --sport 111 -j ACCEPT
-A INPUT -s 172.16.10.25/32 -d 172.16.10.40/32 -i eth0 -p tcp --sport 2049 -j ACCEPT
-A INPUT -s 172.16.10.25/32 -d 172.16.10.40/32 -i eth0 -p udp --sport 111 -j ACCEPT
-A INPUT -s 172.16.10.25/32 -d 172.16.10.40/32 -i eth0 -p udp --sport 2049 -j ACCEPT
-A OUTPUT -s 172.16.10.40/32 -d 172.16.10.25/32 -o eth0 -p tcp --dport 111 -j ACCEPT
-A OUTPUT -s 172.16.10.40/32 -d 172.16.10.25/32 -o eth0 -p tcp --dport 2049 -j ACCEPT
-A OUTPUT -s 172.16.10.40/32 -d 172.16.10.25/32 -o eth0 -p udp --dport 111 -j ACCEPT
-A OUTPUT -s 172.16.10.40/32 -d 172.16.10.25/32 -o eth0 -p udp --dport 2049 -j ACCEPT

IP = .40 being client and .25 being the server. .25 being mounted onto the .40. If this can be done with less rules, then in the future I hope someone finds that answer.