FORMAT¶

The NetRestrict file is in ASCII format. One IP address appears on each line, in dotted decimal format. To specify a network instead, use a slash ("/") followed by a subnet length. The order of the addresses is not significant.

Client NetRestrict¶

The NetRestrict file, if present in a client machine's /etc/openafs directory, defines the IP addresses of the interfaces that the local Cache Manager does not register with a File Server when first establishing a connection to it. For an explanation of how the File Server uses the registered interfaces, see NetInfo(5).

As it initializes, the Cache Manager constructs a list of interfaces to register, from the /etc/openafs/NetInfo file if it exists, or from the list of interfaces configured with the operating system otherwise. The Cache Manager then removes from the list any addresses that appear in the NetRestrict file, if it exists. The Cache Manager records the resulting list in kernel memory.

To display the addresses the Cache Manager is currently registering with File Servers, use the fs getclientaddrs command.

Server NetRestrict¶

The NetRestrict file, if present in the /var/lib/openafs/local directory, defines the following:

• On a file server machine, the local interfaces that the File Server (fileserver process) does not register in the Volume Location Database (VLDB) at initialization time.
• On a database server machine, the local interfaces that the Ubik synchronization library does not use when communicating with the database server processes running on other database server machines.

As it initializes, the File Server constructs a list of interfaces to register, from the /var/lib/openafs/local/NetInfo file if it exists, or from the list of interfaces configured with the operating system otherwise. The File Server then removes from the list any addresses that appear in the NetRestrict file, if it exists. The File Server records the resulting list in the /var/lib/openafs/local/sysid file and registers the interfaces in the VLDB. The database server processes use a similar procedure when initializing, to determine which interfaces to use for communication with the peer processes on other database machines in the cell.

To display the File Server interface addresses registered in the VLDB, use the vos listaddrs command.