Comment # 19 on bug 946325 from Neil Brown

> So NFS client side mounts should always work even if the firewall did not pick up any port mappings.

Not entirely.  Sometimes the server needs to call back to the client.
Typical example is when the client tries to lock a file that is already locked
by some other client.  When that other client releases the lock, the server
connects to the client to tell it that the lock is available.
If the call-back path doesn't work, the first client will eventually re-try the
request, but it will incur significant unnecessary delays.
For NFSv4.1 and later callbacks aren't needed, but for v2, v3, and v4.0, they
are.