NFS client can't mount exported drive

Running on RHEL7.
Common problem when mounting from client:

-bash-4.2# mount -a
mount.nfs4: Connection timed out

Server shows this:

-A INPUT -p udp -m state --state NEW -m udp --dport 20048 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 20048 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 2049 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2049 -j ACCEPT

Plus a number of other NFS-related ports. If I stop the firewall the mount completes. A tcpdump on the client shows '172.19.93.15.890 > 172.19.93.16.nfs', which I am guessing = port 2049. Suggestions?