nfs needs to be allowed since it's in a diff't subnet