I figured it out.
Apparently, the export function stops reading the /etc/export file on any error. The exports that have been read in already and are "valid" are exported, however, any further exports that may be in the file are ignored because processing stops.
Unfortunately, such errors are NOT logged in /var/log/messages (the system error log file) by nfs. So far as I have discovered to date, the ONLY place these errors are reported is by running:
exportfs -a
In this case, most of my entries began with "rw", a few "ro" and the error that caused all this was one that was just "r". Oops! That's where the exporting stopped.
Also worthy of attention are these additional tools that helped me find the problem:
As already noted in the question, here for making a thorough answer, this sends "all" errors to the system log file (/var/log/messages):
rpcdebug -m nfsd -s all
Again,NOT ALL ERRORS ACTUALLY CAN GO HERE, as already noted about /etc/export errors.
List all current exports possible: From a server:
exportfs
From a client:
showmount -e <host>
Note that showmount is a DANGEROUS possible security hole because it can let clients easily know what a server can do and thus about other systems. So in a case like this one, where it's a "firewall / gateway" machine, make sure ONLY root can run it!
And, finally, you can also get a network dump:
tcpdump -s0 -i <interface> host <host_ip> -w <file>
I don't have a good pointer for how to interpret said dump, but you can run strings on it to at least confirm you got the right packets.
