Solved Network setup for iocage

westoz

westoz

Hi I am trying to setup the networking for iocage jails on a 10.2 server , I have followed different howtos but cant access the internet from inside the jail. The server has pf(4) running but it makes no difference if I stop the service, once pf(4) service is stopped there is still no access from inside the jail to the internet. I have set my rc.conf back to its original state to try and start again. Any help would be appreciated. Thanks
 
Hello.
westoz said:
I have followed different howtos but cant access the internet from inside the jail
Click to expand...
Which ones, it could help to see what went wrong. Which command did you use to create the jail(8) ? What messages did you see at jail(8) start ? Did you try to NAT the jail(8) ? Could you also post your /etc/pf.conf file and your /etc/rc.conf (the one you used in your setup) ?
 
Hi, i have the following setup for my first jail ever so take it just like an example ...

/etc/rc.conf
Code: 
cloned_interfaces="lo1"

/etc/pfctl.rules
Code: 
jail_if="lo1"
ext_if="lagg0"

jailnet="192.168.69.0/24"

scrub in all

### Enable NAT for jails subnet
nat on $ext_if from $jailnet to any -> ($ext_if)

### Redirect ssh
rdr pass on $ext_if proto tcp from any to ($ext_if) port 2201 -> 192.168.69.1 port 22

### rules
block log all

pass quick on lo0

pass in on $ext_if proto tcp from any to any port 22 flags S/SA keep state
pass in on $ext_if proto icmp from any to any keep state

pass out on $ext_if

pass in on $jail_if proto tcp from any to any port { 22,80,443 } flags S/SA keep state
pass out on $jail_if

And for the jail myjail1 i set ip address with
iocage ip4_addr="lo1|192.168.69.1" myjail1
 
Once in the jail, could you show the output of % cat /etc/resolv.conf.
 
Hi thanks for your replies my rc.conf is below

Code: 
hostname="beasty"
ifconfig_vtnet0="inet 192.168.1.155 netmask 255.255.255.0"
defaultrouter="192.168.1.5"

cloned_interfaces="lo1"

sshd_enable="YES"
zfs_enable="YES"
openntpd_enable="YES"
iocage_enable="YES"

pf_enable="YES"
pf_rules="/etc/firewall"
pf_flags=""
pflog_enable="YES" 
pflog_logfile="/var/log/pflog"
pflog_flags="" 

sendmail_enable="NONE"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"

# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="AUTO"

and my pf.conf which is parts of a few howto's

Code: 
jail_if="lo1"
ext_if="vtnet0"
jailnet="10.1.1.0/24"

scrub in all

me="vtnet0" 
table <bruteforcers> persist 
table <trusted> persist file "/etc/trusted"
icmp_types = "echoreq" 
junk_ports="{ 135,137,138,139,445,68,67,3222 }"
junk_ip="224.0.0.0/4" 

set loginterface vtnet0 
scrub on vtnet0 reassemble tcp no-df random-id

# ---- First rule obligatory "Pass all on loopback"
pass quick on lo0 all 

# ---- Block junk logs
block quick proto { tcp, udp } from any to $junk_ip
block quick proto { tcp, udp } from any to any port $junk_ports

# ---- Second rule "Block all in and pass all out"
block in log all 
pass out all keep state 

############### FIREWALL ###############################################
# ---- Allow all traffic from my Home
pass quick proto {tcp, udp} from 192.168.2.72 to $me keep state

### Enable NAT for jails subnet
nat on $ext_if from $jailnet to any -> ($ext_if)

# ---- block SMTP out
block quick proto tcp from $me to any port 25

# ---- Allow incoming Web traffic
pass quick proto tcp from any to $me port { 80, 443 } flags S/SA keep state

# ---- Allow my team member SSH access
#pass quick proto tcp from 1.2.3.5 to $me port ssh flags S/SA keep state

# ---- Block bruteforcers
block log quick from <bruteforcers>

# ---- Allow SSH from trusted sources, but block bruteforcers
pass quick proto tcp from <trusted> to $me port ssh \
flags S/SA keep state \
(max-src-conn 10, max-src-conn-rate 20/60, \
overload <bruteforcers> flush global)

# ---- Allow ICMP
pass in inet proto icmp all icmp-type $icmp_types keep state
pass out inet proto icmp all icmp-type $icmp_types keep state
 
Thanks for your help I have fixed the issue I was having and now have access via the jails. I followed your configs ivosevb and added what I needed via trial and error to get it working.
 
You must log in or register to reply here.
Back
Top