diff --git a/.fixtures.yml b/.fixtures.yml
index f777af0..0e2f9d6 100644
--- a/.fixtures.yml
+++ b/.fixtures.yml
@@ -22,7 +22,6 @@ fixtures:
     stunnel: https://github.com/simp/pupmod-simp-stunnel.git
     svckill: https://github.com/simp/pupmod-simp-svckill.git
     systemd: https://github.com/simp/puppet-systemd.git
-    tcpwrappers: https://github.com/simp/pupmod-simp-tcpwrappers.git
     vox_selinux:
       repo: https://github.com/simp/pupmod-voxpupuli-selinux.git
       branch: simp-master
diff --git a/data/common.yaml b/data/common.yaml
index 56b598c..daa45cb 100644
--- a/data/common.yaml
+++ b/data/common.yaml
@@ -2,10 +2,6 @@
 # Common defaults for all operating systems
 # These values will be used unless overridden by OS-specific data
 
-# Controls whether to manage tcpwrappers configuration
-# TCP wrappers was dropped in EL8+
-nfs::manage_tcpwrappers: true
-
 # Controls whether to install quota-rpc package
 # In EL7, rpc.rquotad files were in the quota package
 # In EL8+, quota-rpc package is needed for NFS servers
diff --git a/data/os/RedHat/7.yaml b/data/os/RedHat/7.yaml
index eb1620f..6c796e7 100644
--- a/data/os/RedHat/7.yaml
+++ b/data/os/RedHat/7.yaml
@@ -1,8 +1,6 @@
 ---
 # EL7-specific configuration
 
-# TCP wrappers is supported in EL7
-nfs::manage_tcpwrappers: true
 
 # quota-rpc is not a separate package in EL7
 # (rpc.rquotad files are in the quota package)
diff --git a/data/os/RedHat/8.yaml b/data/os/RedHat/8.yaml
index ca741ee..1853b0a 100644
--- a/data/os/RedHat/8.yaml
+++ b/data/os/RedHat/8.yaml
@@ -1,8 +1,6 @@
 ---
 # EL8-specific configuration
 
-# TCP wrappers was dropped in EL8
-nfs::manage_tcpwrappers: false
 
 # quota-rpc is a separate package in EL8+
 nfs::install_quota_rpc: true
diff --git a/data/os/RedHat/9.yaml b/data/os/RedHat/9.yaml
index d8d3e6c..47a678b 100644
--- a/data/os/RedHat/9.yaml
+++ b/data/os/RedHat/9.yaml
@@ -1,8 +1,6 @@
 ---
 # EL9-specific configuration
 
-# TCP wrappers was dropped in EL8
-nfs::manage_tcpwrappers: false
 
 # quota-rpc is a separate package in EL8+
 nfs::install_quota_rpc: true
diff --git a/manifests/client/config.pp b/manifests/client/config.pp
index f956fd9..7c44831 100644
--- a/manifests/client/config.pp
+++ b/manifests/client/config.pp
@@ -51,10 +51,6 @@
     }
   }
 
-  if $nfs::tcpwrappers {
-    include 'nfs::client::tcpwrappers'
-  }
-
   if $nfs::idmapd {
     include 'nfs::idmapd::client'
   }
diff --git a/manifests/client/config.pp.tmp.877772.1775159215182 b/manifests/client/config.pp.tmp.877772.1775159215182
new file mode 100644
index 0000000..7c44831
--- /dev/null
+++ b/manifests/client/config.pp.tmp.877772.1775159215182
@@ -0,0 +1,57 @@
+# @summary Manage NFS client-specific configuration
+#
+# @api private
+# @author https://github.com/simp/pupmod-simp-nfs/graphs/contributors
+#
+class nfs::client::config {
+
+  assert_private()
+
+  # We need to configure the NFSv4.0 client delegation callback port for the
+  # nfsv4 kernel module, to ensure the port will pass through a firewall (i.e.,
+  # is not ephemeral).  Normally, the nfsv4 kernel module would be loaded when
+  # the mount requiring it is executed.  This dynamic loading doesn't play
+  # well with sysctl.  So, we are going to ensure the kernel module is
+  # configured properly with a static configuration file, load the module if
+  # necessary, and, in case it was already loaded, set the value by sysctl
+  # in nfs::client::service.
+  #
+  # NOTE: The parameter has to be configured via the nfs kernel module (a
+  # dependency of the nfsv4 kernel module), but won't be activated until the
+  # nfsv4 module is loaded.
+  #
+  exec { 'modprobe_nfsv4':
+    command => '/sbin/modprobe nfsv4',
+    unless  => '/sbin/lsmod | /usr/bin/grep -qw nfsv4',
+    require =>  File['/etc/modprobe.d/nfs.conf'],
+    notify  => Sysctl['fs.nfs.nfs_callback_tcpport']
+  }
+
+  $_modprobe_d_nfs_conf = @("NFSCONF")
+    # This file is managed by Puppet (simp-nfs module).  Changes will be overwritten
+    # at the next puppet run.
+    #
+    options nfs callback_tcpport=${nfs::client::callback_port}
+    | NFSCONF
+
+  file { '/etc/modprobe.d/nfs.conf':
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0640',
+    content => $_modprobe_d_nfs_conf
+  }
+
+  if !$nfs::is_server {
+    file { '/etc/exports':
+      ensure  => 'file',
+      mode    => '0644',
+      owner   => 'root',
+      group   => 'root',
+      content => "\n"
+    }
+  }
+
+  if $nfs::idmapd {
+    include 'nfs::idmapd::client'
+  }
+}
diff --git a/manifests/client/mount.pp b/manifests/client/mount.pp
index b2bbd74..22ffd18 100644
--- a/manifests/client/mount.pp
+++ b/manifests/client/mount.pp
@@ -286,7 +286,6 @@
     stunnel_socket_options => $_stunnel_socket_options,
     stunnel_verify         => $_stunnel_verify,
     stunnel_wantedby       => $_stunnel_wantedby,
-    tcpwrappers            => $nfs::tcpwrappers
   }
 
   if $autofs {
diff --git a/manifests/client/mount/connection.pp b/manifests/client/mount/connection.pp
index 480e338..b2033f7 100644
--- a/manifests/client/mount/connection.pp
+++ b/manifests/client/mount/connection.pp
@@ -49,9 +49,6 @@
 #
 #   * Unused when `$stunnel` is `false`
 #
-# @param tcpwrappers
-#   Use the SIMP `tcpwrappers` module to manage TCP wrappers
-#
 # @api private
 # @author https://github.com/simp/pupmod-simp-nfs/graphs/contributors
 #
@@ -65,7 +62,6 @@
   Array[String] $stunnel_socket_options,
   Integer       $stunnel_verify,
   Array[String] $stunnel_wantedby,
-  Boolean       $tcpwrappers
 ) {
 
   # This is only meant to be called from inside nfs::client::mount
@@ -73,7 +69,7 @@
 
   if $stunnel and ($nfs_version == 4) {
     # It is possible that this is called for multiple mounts on the same server.
-    # stunnel-related firewall and tcpwrappers settings handled by the
+    # stunnel-related firewall settings handled by the
     # stunnel::instance, itself.
     ensure_resource('nfs::client::stunnel',
       "${nfs_server}:${nfsd_port}",
@@ -85,7 +81,6 @@
         stunnel_verify         => $stunnel_verify,
         stunnel_wantedby       => $stunnel_wantedby,
         firewall               => $firewall,
-        tcpwrappers            => $tcpwrappers
       }
     )
   } elsif $firewall  {
diff --git a/manifests/client/stunnel.pp b/manifests/client/stunnel.pp
index e712ae0..924ca6d 100644
--- a/manifests/client/stunnel.pp
+++ b/manifests/client/stunnel.pp
@@ -43,9 +43,6 @@
 # @param firewall
 #   Use the SIMP `iptables` module to manage firewall connections
 #
-# @param tcpwrappers
-#   Use the SIMP `tcpwrappers` module to manage TCP wrappers
-#
 # @api private
 # @author https://github.com/simp/pupmod-simp-nfs/graphs/contributors
 #
@@ -57,7 +54,6 @@
   Integer[0]    $stunnel_verify,
   Array[String] $stunnel_wantedby,
   Boolean       $firewall,
-  Boolean       $tcpwrappers
 ) {
   assert_private()
 
@@ -74,7 +70,6 @@
       socket_options   => $stunnel_socket_options,
       systemd_wantedby => $stunnel_wantedby,
       firewall         => $firewall,
-      tcpwrappers      => $tcpwrappers,
       tag              => ['nfs']
     }
   }
diff --git a/manifests/client/tcpwrappers.pp b/manifests/client/tcpwrappers.pp
deleted file mode 100644
index 32dacf1..0000000
--- a/manifests/client/tcpwrappers.pp
+++ /dev/null
@@ -1,24 +0,0 @@
-# @summary Configure TCP wrappers for NFS client services
-#
-# @api private
-# @author https://github.com/simp/pupmod-simp-nfs/graphs/contributors
-#
-class nfs::client::tcpwrappers {
-
-  assert_private()
-
-  # TCP wrappers was dropped in EL8
-  if $nfs::manage_tcpwrappers and $nfs::nfsv3 {
-    include 'tcpwrappers'
-
-    # On EL7, the following NFS-client-related executables are dynamically
-    # linked to libwrap:
-    # * rpc.statd; man page says TCP wrappers under daemon name 'statd'
-    # * rpcbind
-
-    # Both resources in common with nfs::server, which may be on this node.
-    $_allow_options = { pattern => $nfs::trusted_nets }
-    ensure_resource('tcpwrappers::allow', 'rpcbind', $_allow_options)
-    ensure_resource('tcpwrappers::allow', 'statd', $_allow_options)
-  }
-}
diff --git a/manifests/init.pp b/manifests/init.pp
index 64ebae1..958e33a 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -149,9 +149,6 @@
 # @param firewall
 #   Use the SIMP `iptables` module to manage firewall connections
 #
-# @param tcpwrappers
-#   Use the SIMP `tcpwrappers` module to manage TCP wrappers
-#
 # @param stunnel
 #   Wrap `stunnel` around critical NFSv4 connections
 #
@@ -205,12 +202,6 @@
 #   * Stunnel verify for just the NFS server on this host can be controlled
 #     by the `stunnel_verify` parameter in the `nfs::server` class.
 #
-# @param manage_tcpwrappers
-#   Whether tcpwrappers configuration should be managed for NFS services
-#
-#   * Automatically set based on OS version via Hiera (false for EL8+)
-#   * TCP wrappers was dropped in EL8
-#
 # @param install_quota_rpc
 #   Whether to install the quota-rpc package on NFS servers
 #
@@ -236,9 +227,6 @@
 #
 #   * Automatically set via Hiera
 #
-# @param tcpwrappers
-#   Use the SIMP `tcpwrappers` module to manage TCP wrappers
-#
 # @param trusted_nets
 #   The systems that are allowed to connect to this service
 #
@@ -273,9 +261,7 @@
   Simplib::Port         $stunnel_nfsd_port             = 20490,
   Array[String]         $stunnel_socket_options        = ['l:TCP_NODELAY=1','r:TCP_NODELAY=1'],
   Integer               $stunnel_verify                = 2,
-  Boolean               $tcpwrappers                   = simplib::lookup('simp_options::tcpwrappers', { 'default_value' => false }),
   Simplib::Netlist      $trusted_nets                  = simplib::lookup('simp_options::trusted_nets', { 'default_value' => ['127.0.0.1'] }),
-  Boolean               $manage_tcpwrappers            = true,
   Boolean               $install_quota_rpc             = false,
   Boolean               $manage_sysconfig_nfs          = false,
   Boolean               $apply_selinux_hotfix          = false,
@@ -295,10 +281,6 @@
     simplib::assert_optional_dependency($module_name, 'simp/krb5')
   }
 
-  if $tcpwrappers and $manage_tcpwrappers {
-    simplib::assert_optional_dependency($module_name, 'simp/tcpwrappers')
-  }
-
   include 'nfs::install'
 
   if $kerberos and $apply_selinux_hotfix {
diff --git a/manifests/server/config.pp b/manifests/server/config.pp
index f796f5b..82903cc 100644
--- a/manifests/server/config.pp
+++ b/manifests/server/config.pp
@@ -178,7 +178,4 @@
     content => $_simp_etc_exports_service
   }
 
-  if $nfs::tcpwrappers {
-    include 'nfs::server::tcpwrappers'
-  }
 }
diff --git a/manifests/server/stunnel.pp b/manifests/server/stunnel.pp
index f8c9d36..28359d3 100644
--- a/manifests/server/stunnel.pp
+++ b/manifests/server/stunnel.pp
@@ -42,7 +42,6 @@
     socket_options   => $nfs::server::stunnel_socket_options,
     systemd_wantedby => $nfs::server::stunnel_wantedby,
     firewall         => $nfs::firewall,
-    tcpwrappers      => $nfs::tcpwrappers,
     tag              => ['nfs']
   }
 }
diff --git a/manifests/server/tcpwrappers.pp b/manifests/server/tcpwrappers.pp
deleted file mode 100644
index aad485d..0000000
--- a/manifests/server/tcpwrappers.pp
+++ /dev/null
@@ -1,44 +0,0 @@
-# @summary Configure TCP wrappers for NFS server services
-#
-# @api private
-# @author https://github.com/simp/pupmod-simp-nfs/graphs/contributors
-#
-class nfs::server::tcpwrappers
-{
-  assert_private()
-
-  # TCP wrappers was dropped in EL8
-  if $nfs::manage_tcpwrappers {
-    include 'tcpwrappers'
-
-    # On EL7, the following NFS-server-related executables are dynamically
-    # linked to libwrap:
-    # * rpc.rquotad; man page says TCP wrappers service name 'rquotad'
-    # * rpc.statd; man page says TCP wrappers under daemon name 'statd'
-    # * rpc.mountd; man page says TCP wrappers under daemon name 'mountd'
-    # * exportfs; not a daemon so not appropriate
-    # * rpcbind
-    #
-    # stunnel also uses TCP wrappers with a service name that matches the
-    # tunnel's service name. The tcpwrappers::allow is handled by the stunnel
-    # module.
-
-    $_allow_options = { pattern => $nfs::trusted_nets }
-
-    # Resource in common with nfs::client, which may be on this node.
-    ensure_resource('tcpwrappers::allow', 'rpcbind', $_allow_options)
-
-    if $nfs::server::nfsd_vers3 {
-      # Resource in common with nfs::client, which may be on this node.
-      ensure_resource('tcpwrappers::allow', 'statd', $_allow_options)
-
-      $_allow = [ 'mountd', 'rquotad' ]
-    } else {
-      $_allow = ['rquotad']
-    }
-
-    tcpwrappers::allow { $_allow:
-      pattern => $nfs::server::trusted_nets
-    }
-  }
-}
diff --git a/metadata.json b/metadata.json
index 4020561..8828475 100644
--- a/metadata.json
+++ b/metadata.json
@@ -60,10 +60,6 @@
       {
         "name": "simp/stunnel",
         "version_requirement": ">= 6.6.0 < 7.0.0"
-      },
-      {
-        "name": "simp/tcpwrappers",
-        "version_requirement": ">= 6.2.0 < 7.0.0"
       }
     ]
   },
diff --git a/spec/acceptance/suites/default/00_basic_test_spec.rb b/spec/acceptance/suites/default/00_basic_test_spec.rb
index 85f6392..8d50933 100644
--- a/spec/acceptance/suites/default/00_basic_test_spec.rb
+++ b/spec/acceptance/suites/default/00_basic_test_spec.rb
@@ -5,17 +5,13 @@
 describe 'nfs basic' do
   servers = hosts_with_role(hosts, 'nfs_server')
   servers_with_client = hosts_with_role(hosts, 'nfs_server_and_client')
-  servers_tcpwrappers = servers.select { |server| server.name.include?('el7') }
-
   clients = hosts_with_role(hosts, 'nfs_client')
-  clients_tcpwrappers = clients.select { |client| client.name.include?('el7') }
 
   base_hiera = {
     # Set us up for a basic NFS (firewall-only)
     'simp_options::firewall'                => true,
     'simp_options::kerberos'                => false,
     'simp_options::stunnel'                 => false,
-    'simp_options::tcpwrappers'             => false,
     'ssh::server::conf::permitrootlogin'    => true,
     'ssh::server::conf::authorizedkeysfile' => '.ssh/authorized_keys',
 
@@ -65,57 +61,4 @@
     end
   end
 
-  context 'with firewall and tcpwrappers' do
-    tcpwrappers_hiera = {
-      'simp_options::tcpwrappers' => true,
-
-      # use as much TCP as possible for NFS
-      'nfs::custom_nfs_conf_opts' => {
-        'nfsd' => {
-          'tcp' => true,
-          'udp' => false,
-        },
-      },
-    }
-
-    context 'NFSv4 with firewall and tcpwrappers' do
-      opts = {
-        base_hiera: base_hiera.merge(tcpwrappers_hiera),
-        export_insecure: false,
-        nfs_sec: 'sys',
-        nfsv3: false,
-        verify_reboot: false,
-      }
-
-      it_behaves_like 'a NFS share using static mounts with distinct client/server roles',
-        servers_tcpwrappers, clients_tcpwrappers, opts
-
-      it_behaves_like 'a NFS share using autofs with distinct client/server roles',
-        servers_tcpwrappers, clients_tcpwrappers, opts
-    end
-
-    context 'NFSv3 with firewall and tcpwrappers' do
-      opts = {
-        base_hiera: base_hiera.merge(tcpwrappers_hiera),
-        export_insecure: false,
-        nfs_sec: 'sys',
-        nfsv3: true,
-        verify_reboot: false,
-      }
-
-      it_behaves_like 'a NFS share using static mounts with distinct client/server roles',
-        servers_tcpwrappers, clients_tcpwrappers, opts
-
-      it_behaves_like 'a NFS share using autofs with distinct client/server roles',
-        servers_tcpwrappers, clients_tcpwrappers, opts
-    end
-
-    context 'clean up for next test' do
-      (servers_tcpwrappers + clients_tcpwrappers).each do |host|
-        it 'disables tcpwrappers by removing hosts.allow and hosts.deny files' do
-          on(host, 'rm -f /etc/hosts.allow /etc/hosts.deny')
-        end
-      end
-    end
-  end
 end
diff --git a/spec/acceptance/suites/default/10_cross_server_mounts_test_spec.rb b/spec/acceptance/suites/default/10_cross_server_mounts_test_spec.rb
index 42f7ec1..16a8a2c 100644
--- a/spec/acceptance/suites/default/10_cross_server_mounts_test_spec.rb
+++ b/spec/acceptance/suites/default/10_cross_server_mounts_test_spec.rb
@@ -22,7 +22,6 @@
     'simp_options::firewall'                => true,
     'simp_options::kerberos'                => false,
     'simp_options::stunnel'                 => false,
-    'simp_options::tcpwrappers'             => false,
     'ssh::server::conf::permitrootlogin'    => true,
     'ssh::server::conf::authorizedkeysfile' => '.ssh/authorized_keys',
 
diff --git a/spec/acceptance/suites/default/20_idmapd_test_spec.rb b/spec/acceptance/suites/default/20_idmapd_test_spec.rb
index 836d2fc..00c511b 100644
--- a/spec/acceptance/suites/default/20_idmapd_test_spec.rb
+++ b/spec/acceptance/suites/default/20_idmapd_test_spec.rb
@@ -11,7 +11,6 @@
     'simp_options::firewall'                => true,
     'simp_options::kerberos'                => false,
     'simp_options::stunnel'                 => false,
-    'simp_options::tcpwrappers'             => false,
     'ssh::server::conf::permitrootlogin'    => true,
     'ssh::server::conf::authorizedkeysfile' => '.ssh/authorized_keys',
 
diff --git a/spec/acceptance/suites/krb5/00_krb5_test_spec.rb b/spec/acceptance/suites/krb5/00_krb5_test_spec.rb
index ea1693e..9dd65de 100644
--- a/spec/acceptance/suites/krb5/00_krb5_test_spec.rb
+++ b/spec/acceptance/suites/krb5/00_krb5_test_spec.rb
@@ -15,7 +15,6 @@
     'simp_options::firewall'                   => true,
     'simp_options::kerberos'                   => true,
     'simp_options::stunnel'                    => false,
-    'simp_options::tcpwrappers'                => true,
     'ssh::server::conf::permitrootlogin'       => true,
     'ssh::server::conf::authorizedkeysfile'    => '.ssh/authorized_keys',
     'simp_options::pki'                        => true,
@@ -120,7 +119,7 @@
         end
       end
 
-      context 'Secure NFSv4 with firewall and tcpwrappers' do
+      context 'Secure NFSv4 with firewall' do
         server_krb5_manifest_extras = <<~EOM
           # Keep KRB5 (kadmin & krb5kdc) ports open in firewall so clients can
           # talk to KDC
diff --git a/spec/acceptance/suites/stunnel/00_stunnel_test_spec.rb b/spec/acceptance/suites/stunnel/00_stunnel_test_spec.rb
index 8f755fe..6382e14 100644
--- a/spec/acceptance/suites/stunnel/00_stunnel_test_spec.rb
+++ b/spec/acceptance/suites/stunnel/00_stunnel_test_spec.rb
@@ -33,10 +33,7 @@
 describe 'nfs stunnel' do
   servers = hosts_with_role(hosts, 'nfs_server')
   servers_with_client = hosts_with_role(hosts, 'nfs_server_and_client')
-  servers_tcpwrappers = servers.select { |server| server.name.include?('el7') }
-
   clients = hosts_with_role(hosts, 'nfs_client')
-  clients_tcpwrappers = clients.select { |client| client.name.include?('el7') }
 
   base_hiera = {
     # Set us up for a basic stunneled NFS (firewall-only)
@@ -47,7 +44,6 @@
     'simp_options::pki'                     => true,
     'simp_options::pki::source'             => '/etc/pki/simp-testing/pki',
     'simp_options::stunnel'                 => true,
-    'simp_options::tcpwrappers'             => false,
     'ssh::server::conf::permitrootlogin'    => true,
     'ssh::server::conf::authorizedkeysfile' => '.ssh/authorized_keys',
 
@@ -83,39 +79,4 @@
     end
   end
 
-  context 'with NFSv4 stunnel, firewall and tcpwrappers' do
-    tcpwrappers_hiera = {
-      'simp_options::tcpwrappers' => true,
-
-      # use as much TCP as possible for NFS
-      'nfs::custom_nfs_conf_opts' => {
-        'nfsd' => {
-          'tcp' => true,
-          'udp' => false,
-        },
-      },
-    }
-
-    opts = {
-      base_hiera: base_hiera.merge(tcpwrappers_hiera),
-      export_insecure: true,
-      nfs_sec: 'sys',
-      nfsv3: false,
-      verify_reboot: false,
-    }
-
-    it_behaves_like 'a NFS share using static mounts with distinct client/server roles',
-      servers_tcpwrappers, clients_tcpwrappers, opts
-
-    it_behaves_like 'a NFS share using autofs with distinct client/server roles',
-      servers_tcpwrappers, clients_tcpwrappers, opts
-  end
-
-  context 'clean up for next test' do
-    (servers_tcpwrappers + clients_tcpwrappers).each do |host|
-      it 'disables tcpwrappers by removing hosts.allow and hosts.deny files' do
-        on(host, 'rm -f /etc/hosts.allow /etc/hosts.deny')
-      end
-    end
-  end
 end
diff --git a/spec/acceptance/suites/stunnel/10_client_with_multiple_servers_test_spec.rb b/spec/acceptance/suites/stunnel/10_client_with_multiple_servers_test_spec.rb
index ff349ef..2d454ab 100644
--- a/spec/acceptance/suites/stunnel/10_client_with_multiple_servers_test_spec.rb
+++ b/spec/acceptance/suites/stunnel/10_client_with_multiple_servers_test_spec.rb
@@ -32,7 +32,6 @@
     'simp_options::pki::source'             => '/etc/pki/simp-testing/pki',
     # will only apply to NFSv4 connections
     'simp_options::stunnel'                 => true,
-    'simp_options::tcpwrappers'             => false,
     'ssh::server::conf::permitrootlogin'    => true,
     'ssh::server::conf::authorizedkeysfile' => '.ssh/authorized_keys',
 
diff --git a/spec/acceptance/suites/stunnel/20_server_with_multiple_clients_test_spec.rb b/spec/acceptance/suites/stunnel/20_server_with_multiple_clients_test_spec.rb
index 1cb18f0..5aa6d72 100644
--- a/spec/acceptance/suites/stunnel/20_server_with_multiple_clients_test_spec.rb
+++ b/spec/acceptance/suites/stunnel/20_server_with_multiple_clients_test_spec.rb
@@ -33,7 +33,6 @@
     # Will only apply to NFSv4 connections
     'simp_options::stunnel'                 => true,
 
-    'simp_options::tcpwrappers'             => false,
     'ssh::server::conf::permitrootlogin'    => true,
     'ssh::server::conf::authorizedkeysfile' => '.ssh/authorized_keys',
 
diff --git a/spec/acceptance/suites/stunnel/30_cross_server_mounts_test_spec.rb b/spec/acceptance/suites/stunnel/30_cross_server_mounts_test_spec.rb
index 1129970..7c42ae9 100644
--- a/spec/acceptance/suites/stunnel/30_cross_server_mounts_test_spec.rb
+++ b/spec/acceptance/suites/stunnel/30_cross_server_mounts_test_spec.rb
@@ -32,7 +32,6 @@
     'simp_options::pki'                     => true,
     'simp_options::pki::source'             => '/etc/pki/simp-testing/pki',
     'simp_options::stunnel'                 => true,
-    'simp_options::tcpwrappers'             => false,
     'ssh::server::conf::permitrootlogin'    => true,
     'ssh::server::conf::authorizedkeysfile' => '.ssh/authorized_keys',
 
diff --git a/spec/classes/client/config_spec.rb b/spec/classes/client/config_spec.rb
index 1e0b333..f5efacf 100644
--- a/spec/classes/client/config_spec.rb
+++ b/spec/classes/client/config_spec.rb
@@ -44,7 +44,6 @@
             )
           }
 
-          it { is_expected.not_to create_class('nfs::client::tcpwrappers') }
           it { is_expected.not_to create_class('nfs::idmapd::client') }
         end
 
@@ -56,14 +55,6 @@
           it { is_expected.not_to create_file('/etc/exports') }
         end
 
-        context 'when nfs::tcpwrappers=true' do
-          let(:params) { { tcpwrappers: true } }
-
-          it { is_expected.to compile.with_all_deps }
-          it { is_expected.to create_class('nfs::client::config') }
-          it { is_expected.to create_class('nfs::client::tcpwrappers') }
-        end
-
         context 'when nfs::idmapd=true' do
           let(:params) { { idmapd: true } }
 
diff --git a/spec/classes/client/tcpwrappers_spec.rb b/spec/classes/client/tcpwrappers_spec.rb
deleted file mode 100644
index 21586d9..0000000
--- a/spec/classes/client/tcpwrappers_spec.rb
+++ /dev/null
@@ -1,64 +0,0 @@
-require 'spec_helper'
-
-# Testing private nfs::client::tcpwrappers class via nfs class
-describe 'nfs' do
-  describe 'private nfs::client::tcpwrappers' do
-    on_supported_os.each do |os, os_facts|
-      context "on #{os}" do
-        let(:facts) do
-          # to workaround service provider issues related to masking haveged
-          # when tests are run on GitLab runners which are docker containers
-          os_facts.merge(haveged__rngd_enabled: false)
-        end
-
-        context 'when tcpwrappers and nfsv3 enabled' do
-          let(:params) do
-            {
-              nfsv3: true,
-              tcpwrappers: true,
-              trusted_nets: [ '1.2.3.0/24' ],
-            }
-          end
-
-          it { is_expected.to compile.with_all_deps }
-          it { is_expected.to create_class('nfs::client::tcpwrappers') }
-
-          if os_facts[:os][:release][:major].to_i > 7
-            it { is_expected.not_to create_class('tcpwrappers') }
-            it { is_expected.not_to create_tcpwrappers__allow('rpcbind') }
-            it { is_expected.not_to create_tcpwrappers__allow('statd') }
-          else
-            it { is_expected.to create_class('tcpwrappers') }
-            it {
-              is_expected.to create_tcpwrappers__allow('rpcbind').with_pattern(
-              params[:trusted_nets],
-            )
-            }
-
-            it {
-              is_expected.to create_tcpwrappers__allow('statd') .with_pattern(
-              params[:trusted_nets],
-            )
-            }
-          end
-        end
-
-        context 'when tcpwrappers enabled and nfsv3 disabled' do
-          let(:params) do
-            {
-              nfsv3: false,
-              tcpwrappers: true,
-              trusted_nets: [ '1.2.3.0/24' ],
-            }
-          end
-
-          it { is_expected.to compile.with_all_deps }
-          it { is_expected.to create_class('nfs::client::tcpwrappers') }
-          it { is_expected.not_to create_class('tcpwrappers') }
-          it { is_expected.not_to create_tcpwrappers__allow('rpcbind') }
-          it { is_expected.not_to create_tcpwrappers__allow('statd') }
-        end
-      end
-    end
-  end
-end
diff --git a/spec/classes/server/config_spec.rb b/spec/classes/server/config_spec.rb
index 5764f07..7e43bd0 100644
--- a/spec/classes/server/config_spec.rb
+++ b/spec/classes/server/config_spec.rb
@@ -413,18 +413,6 @@
           }
         end
 
-        context 'when tcpwrappers enabled' do
-          let(:params) do
-            {
-              is_server: true,
-              tcpwrappers: true,
-            }
-          end
-
-          it { is_expected.to compile.with_all_deps }
-          it { is_expected.to create_class('nfs::server::config') }
-          it { is_expected.to create_class('nfs::server::tcpwrappers') }
-        end
       end
     end
   end
diff --git a/spec/classes/server/stunnel_spec.rb b/spec/classes/server/stunnel_spec.rb
index 0fb1c5a..459ca73 100644
--- a/spec/classes/server/stunnel_spec.rb
+++ b/spec/classes/server/stunnel_spec.rb
@@ -16,7 +16,6 @@
             is_server: true,
             firewall: true,
             stunnel: true,
-            tcpwrappers: true,
             trusted_nets: ['1.2.3.0/24'],
           }
         end
@@ -34,7 +33,6 @@
             socket_options: ['l:TCP_NODELAY=1', 'r:TCP_NODELAY=1'],
             systemd_wantedby: ['nfs-server.service'],
             firewall: true,
-            tcpwrappers: true,
             tag: ['nfs'],
           )
         }
diff --git a/spec/classes/server/tcpwrappers_spec.rb b/spec/classes/server/tcpwrappers_spec.rb
deleted file mode 100644
index bae0e65..0000000
--- a/spec/classes/server/tcpwrappers_spec.rb
+++ /dev/null
@@ -1,135 +0,0 @@
-require 'spec_helper'
-
-# Testing private nfs::server::tcpwrappers class via nfs class
-describe 'nfs' do
-  describe 'private nfs::server::tcpwrappers' do
-    on_supported_os.each do |os, os_facts|
-      context "on #{os}" do
-        let(:facts) do
-          # to workaround service provider issues related to masking haveged
-          # when tests are run on GitLab runners which are docker containers
-          os_facts.merge(haveged__rngd_enabled: false)
-        end
-
-        context 'when tcpwrappers and nfsv3 enabled' do
-          let(:params) do
-            {
-              is_server: true,
-              nfsv3: true,
-              tcpwrappers: true,
-              trusted_nets: [ '1.2.3.0/24' ],
-            }
-          end
-
-          it { is_expected.to compile.with_all_deps }
-          it { is_expected.to create_class('nfs::server::tcpwrappers') }
-
-          if os_facts[:os][:release][:major].to_i > 7
-            it { is_expected.not_to create_class('tcpwrappers') }
-            it { is_expected.not_to create_tcpwrappers__allow('rpcbind') }
-            it { is_expected.not_to create_tcpwrappers__allow('statd') }
-            it { is_expected.not_to create_tcpwrappers__allow('mountd') }
-            it { is_expected.not_to create_tcpwrappers__allow('rquotad') }
-          else
-            it { is_expected.to create_class('tcpwrappers') }
-            it {
-              is_expected.to create_tcpwrappers__allow('rpcbind').with_pattern(
-                params[:trusted_nets],
-              )
-            }
-
-            it {
-              is_expected.to create_tcpwrappers__allow('statd').with_pattern(
-                params[:trusted_nets],
-              )
-            }
-
-            it {
-              is_expected.to create_tcpwrappers__allow('mountd').with_pattern(
-                params[:trusted_nets],
-              )
-            }
-
-            it {
-              is_expected.to create_tcpwrappers__allow('rquotad').with_pattern(
-                params[:trusted_nets],
-              )
-            }
-          end
-        end
-
-        context 'when tcpwrappers and nfsv3 enabled only for client' do
-          let(:hieradata) { 'nfs_nfsv3_and_not_nfs_server_nfsd_vers3' }
-          let(:params) do
-            {
-              tcpwrappers: true,
-              trusted_nets: [ '1.2.3.0/24' ],
-            }
-          end
-
-          it { is_expected.to compile.with_all_deps }
-          it { is_expected.to create_class('nfs::server::tcpwrappers') }
-
-          if os_facts[:os][:release][:major].to_i > 7
-            it { is_expected.not_to create_class('tcpwrappers') }
-            it { is_expected.not_to create_tcpwrappers__allow('rpcbind') }
-            it { is_expected.not_to create_tcpwrappers__allow('statd') }
-            it { is_expected.not_to create_tcpwrappers__allow('rquotad') }
-          else
-            it { is_expected.to create_class('tcpwrappers') }
-            it {
-              is_expected.to create_tcpwrappers__allow('rpcbind').with_pattern(
-                params[:trusted_nets],
-              )
-            }
-
-            # allowed by base config
-            it { is_expected.to create_tcpwrappers__allow('statd') }
-
-            it {
-              is_expected.to create_tcpwrappers__allow('rquotad').with_pattern(
-                params[:trusted_nets],
-              )
-            }
-          end
-          it { is_expected.not_to create_tcpwrappers__allow('mountd') }
-        end
-
-        context 'when tcpwrappers enabled and nfsv3 disabled' do
-          let(:params) do
-            {
-              is_server: true,
-              nfsv3: false,
-              tcpwrappers: true,
-              trusted_nets: [ '1.2.3.0/24' ],
-            }
-          end
-
-          it { is_expected.to compile.with_all_deps }
-          it { is_expected.to create_class('nfs::server::tcpwrappers') }
-
-          if os_facts[:os][:release][:major].to_i > 7
-            it { is_expected.not_to create_class('tcpwrappers') }
-            it { is_expected.not_to create_tcpwrappers__allow('rpcbind') }
-            it { is_expected.not_to create_tcpwrappers__allow('rquotad') }
-          else
-            it { is_expected.to create_class('tcpwrappers') }
-            it {
-              is_expected.to create_tcpwrappers__allow('rpcbind').with_pattern(
-                params[:trusted_nets],
-              )
-            }
-
-            it {
-              is_expected.to create_tcpwrappers__allow('rquotad').with_pattern(
-                params[:trusted_nets],
-              )
-            }
-          end
-          it { is_expected.not_to create_tcpwrappers__allow('statd') }
-          it { is_expected.not_to create_tcpwrappers__allow('mountd') }
-        end
-      end
-    end
-  end
-end
diff --git a/spec/defines/client/mount/connection_spec.rb b/spec/defines/client/mount/connection_spec.rb
index 4b93786..f21cc8a 100644
--- a/spec/defines/client/mount/connection_spec.rb
+++ b/spec/defines/client/mount/connection_spec.rb
@@ -29,7 +29,6 @@
             stunnel_socket_options: ['l:TCP_NODELAY=1', 'r:TCP_NODELAY=1'],
             stunnel_verify: 2,
             stunnel_wantedby: ['remote-fs-pre.target'],
-            tcpwrappers: true,
           }
         end
 
@@ -44,7 +43,6 @@
             stunnel_verify: params[:stunnel_verify],
             stunnel_wantedby: params[:stunnel_wantedby],
             firewall: params[:firewall],
-            tcpwrappers: params[:tcpwrappers],
           )
         }
 
@@ -66,7 +64,6 @@
               stunnel_socket_options: ['l:TCP_NODELAY=1', 'r:TCP_NODELAY=1'],
               stunnel_verify: 2,
               stunnel_wantedby: ['remote-fs-pre.target'],
-              tcpwrappers: true,
             }
           end
 
@@ -92,7 +89,6 @@
                 stunnel_socket_options: ['l:TCP_NODELAY=1', 'r:TCP_NODELAY=1'],
                 stunnel_verify: 2,
                 stunnel_wantedby: ['remote-fs-pre.target'],
-                tcpwrappers: true,
               }
             end
 
@@ -123,7 +119,6 @@
                 stunnel_socket_options: ['l:TCP_NODELAY=1', 'r:TCP_NODELAY=1'],
                 stunnel_verify: 2,
                 stunnel_wantedby: ['remote-fs-pre.target'],
-                tcpwrappers: true,
               }
             end
 
diff --git a/spec/defines/client/mount_spec.rb b/spec/defines/client/mount_spec.rb
index 4c2764f..cd7fda5 100644
--- a/spec/defines/client/mount_spec.rb
+++ b/spec/defines/client/mount_spec.rb
@@ -45,7 +45,6 @@
               stunnel_socket_options: ['l:TCP_NODELAY=1', 'r:TCP_NODELAY=1'], # from nfs::client
               stunnel_verify: 2, # from nfs::client
               stunnel_wantedby: ['remote-fs-pre.target'], # from nfs::client
-              tcpwrappers: false, # from nfs
             )
           end
 
@@ -77,7 +76,6 @@
               stunnel_socket_options: ['l:TCP_NODELAY=2', 'r:TCP_NODELAY=2'], # from nfs::client
               stunnel_verify: 1, # from nfs::client
               stunnel_wantedby: ['remote-fs-pre.target', 'some-other.service'], # from nfs::client
-              tcpwrappers: true, # from nfs
             )
           end
         end
diff --git a/spec/defines/client/stunnel_spec.rb b/spec/defines/client/stunnel_spec.rb
index 781621a..0b88583 100644
--- a/spec/defines/client/stunnel_spec.rb
+++ b/spec/defines/client/stunnel_spec.rb
@@ -24,7 +24,6 @@
           stunnel_verify: 2,
           stunnel_wantedby: ['remote-fs-pre.target'],
           firewall: true,
-          tcpwrappers: true,
         }
       end
 
@@ -43,7 +42,6 @@
             socket_options: params[:stunnel_socket_options],
             systemd_wantedby: params[:stunnel_wantedby],
             firewall: params[:firewall],
-            tcpwrappers: params[:tcpwrappers],
             tag: ['nfs'],
           )
         }
diff --git a/spec/fixtures/hieradata/nfs_client_mount_custom.yaml b/spec/fixtures/hieradata/nfs_client_mount_custom.yaml
index c5b6d70..393f77c 100644
--- a/spec/fixtures/hieradata/nfs_client_mount_custom.yaml
+++ b/spec/fixtures/hieradata/nfs_client_mount_custom.yaml
@@ -3,7 +3,6 @@ nfs::nfsd_port: 2050
 nfs::stunnel_nfsd_port: 20500
 nfs::firewall: true
 nfs::stunnel: false
-nfs::tcpwrappers: true
 
 nfs::client::stunnel: true
 nfs::client::stunnel_socket_options: