diff --git a/kubernetes/nfs-test.yaml b/kubernetes/nfs-test.yaml
new file mode 100644
index 0000000..2b53aab
--- /dev/null
+++ b/kubernetes/nfs-test.yaml
@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: fedoratest
+  name: fedoratest
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: fedoratest
+  template:
+    metadata:
+      labels:
+        app: fedoratest
+    spec:
+      containers:
+        - image: registry.fedoraproject.org/fedora:35
+          name: fedora
+          command: ["/bin/bash", "-c", "--"]
+          args: ["while true; do sleep 30; done;"]
+          volumeMounts:
+          # name must match the volume name below
+          - name: media
+            mountPath: "/mnt/media"
+      volumes:
+      - name: media
+        persistentVolumeClaim:
+          claimName: media
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: media
+spec:
+  capacity:
+    storage: 1Mi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: lewis.hyp
+    path: "/mnt/data/nfs/media"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: media
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  resources:
+    requests:
+      storage: 1Mi
+  volumeName: media
diff --git a/nix/default.nix b/nix/default.nix
index 58512f1..11b0681 100644
--- a/nix/default.nix
+++ b/nix/default.nix
@@ -96,6 +96,7 @@
       pciutils
       dmidecode
       openssl
+      nfs-utils
     ];
 
     nixpkgs.overlays = [
diff --git a/nix/modules/data-sharing.nix b/nix/modules/data-sharing.nix
index c74c7e1..85e2e1c 100644
--- a/nix/modules/data-sharing.nix
+++ b/nix/modules/data-sharing.nix
@@ -33,7 +33,7 @@ let
   nfsExports = lib.strings.concatLines (
     builtins.map
       (share:
-        "${cfg.nfsRoot}${share} 192.168.30.0/${config.lab.networking.dmz.ipv4.prefixLength}(rw,sync,no_subtree_check,no_root_squash)"
+        "${cfg.nfsRoot}${share} 192.168.30.0/16(rw,sync,no_subtree_check,no_root_squash)"
       )
       nfsShares
   );
@@ -66,7 +66,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    networking.firewall.interfaces.${config.lab.networking.dmz.bridgeName}.allowedTCPPorts = [
+    networking.firewall.allowedTCPPorts = [
       2049 # NFS
       5432 # PostgeSQL
       111 # NFS