The NFS server listens on port 2049. NFSv4 works with this single TCP port; NFSv3 also needs rpcbind (111) plus mountd and lockd on usually dynamic ports, which you should pin in /etc/nfs.conf.
NFS never belongs on the internet. Without Kerberos (sec=krb5p) NFS trusts the client's UIDs – security comes only from the network and /etc/exports. Between sites, use a VPN.
Typical: Permission denied from root_squash or mismatched UIDs between client and server, and hanging hard mounts when the server disappears.
Check
nc -vz nfs.example.com 2049