diff --git a/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java b/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java
index 249c5bcb56d..6ad6e5fcda5 100644
--- a/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java
+++ b/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java
@@ -2225,7 +2225,13 @@ public class NfsSecondaryStorageResource extends ServerResourceBase implements S
         return null;
     }
 
-    public String allowOutgoingOnPrivate(String destCidr) {
+    /**
+    * allow *only one* setting of an outgoing destination at a time
+    *
+    * @destCidr the destination network that will be allowed for outgoing traffic.
+    * @return any error message that might be helpful or <null> on success or when called anywhere but in the router VM.
+    */
+    public synchronized String allowOutgoingOnPrivate(String destCidr) {
         if (!_inSystemVM) {
             return null;
         }