VNET jail with IPFW won't log

jtocci · 2026-09-25T01:01:20+0100

I am confused. I have a working vnet jail with it's own ethernet connection. IPFW works. DNS works. pkg works. I can fetch websites.
But for some reason I get no logs in /var/log/security or in /var/log/ipfw.log

Here are a few of the log lines I have in my ipfw.rules:

Code:

ipfw add 210 allow log tcp from me to any via ng0_web setup keep-state
ipfw add 211 allow log udp from me to any via ng0_web keep-state
ipfw add 213 allow log udp from me to 192.168.88.1 53 xmit ng0_web keep-state

Anyone have any hints for me? I've checked the handbook but it seems IPFW should work the same in a VNET jail as on host.
I've been all over the freebsd forums, various tutorials. All the information is stuff I've check over and over now.
Any help will be very appreciated.

% ifconfig

Code:

lo0: flags=1008049<UP,LOOPBACK,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 16384
        options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
        inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x8
        groups: lo
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
ng0_web: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        options=28<VLAN_MTU,JUMBO_MTU>
        ether 1c:86:0b:38:88:df
        hwaddr 58:9c:fc:10:30:b3
        inet 192.168.88.2 netmask 0xffffff00 broadcast 192.168.88.255
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

rc.conf:

Code:

firewall_enable="YES"
firewall_script="/etc/ipfw.rules"
firewall_logging="YES"

syslog.conf

Code:

*.err;kern.warning;auth.notice;mail.crit                /dev/console
*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err   /var/log/messages
security.*                              /var/log/security
auth.info;authpriv.info                 /var/log/auth.log
mail.info                               /var/log/maillog
cron.*                                  /var/log/cron
!-devd
*.=debug                                /var/log/debug.log
*.emerg                                 *
daemon.info                             /var/log/daemon.log
!ipfw
*.*                         /var/log/ipfw.log

-snip-

sysctl.conf:

Code:

net.inet.ip.fw.verbose: 1
net.inet.ip.fw.verbose_limit: 1

host jail.conf:

Code:

exec.timeout=120;
stop.timeout=120;
sysvmsg = new;          # prevent security issues with sysv memory being shared across jails and to host
sysvsem = new;          # leave all three uncommented to make sure shared memory is not used
sysvshm = new;          # this one also prevents problems with postgres starting
exec.clean;             # default jails will inherit environment vars from parent. this stops that.
mount.devfs;            # minimum devices list

# shortcuts
path="/j1459/${name}"; # set to mountpath of jail, not dataset location
                     # note: if jail fails to start, try `zfs mount zroot/jail/${name}`
host.hostname="${name}.example.com";
exec.consolelog="/var/log/${name}.jail";
devfs_ruleset="1000"; # vnet rule set

vnet.interface="ng0_${name}";
allow.mount;
allow.mount.zfs;
enforce_statfs=1;
exec.created="jmz start ${name} ${path}";
exec.prestart="jng bridge ${name} igb1";
exec.start="zfs mount -a";
exec.start+="/bin/sh /etc/rc";

exec.prestop="ifconfig ng0_${name} -vnet ${name} || echo";
exec.stop="/bin/sh /etc/rc.shutdown";
exec.poststop="jng shutdown ${name}";
exec.poststop+="ngctl shutdown ng0_${name}";

web {
        vnet;
        allow.raw_sockets;
        allow.socket_af;
        exec.prestart="sudo rm -f /j1459/web/var/run/wpa_supplicant/ng0_${name}";
        exec.prestart+="jng bridge ${name} =igb1";
        host.hostname = "web.example.com";
}

covacat · 2026-09-25T08:14:07+0100

check /var/log/security

VNET jail with IPFW won't log

jtocci

covacat