Solved Pinging internet from within a jail

B

balanga

I can ping the internet from within a jail on my home network but I can't do the same thing from within a jail on my VPS.

What is missing?

I don't have pf running on it at the moment.
 
Code: 
             allow.raw_sockets
                     The jail root is allowed to create raw sockets.  Setting
                     this parameter allows utilities like ping(8) and
                     traceroute(8) to operate inside the jail.  If this is
                     set, the source IP addresses are enforced to comply with
                     the IP address bound to the jail, regardless of whether
                     or not the IP_HDRINCL flag has been set on the socket.
                     Since raw sockets can be used to configure and interact
                     with various network subsystems, extra caution should be
                     used where privileged access to jails is given out to
                     untrusted parties.
jail(8)
 
balanga said:
I don't have pf running on it at the moment.
Click to expand...
To allow access for the jails to the internet, you need to configure and run pf(4) to connect (NAT) the bridge0 (10.0.0.1) to the internet facing interface (vtnet0: 168.235.83.112). allow.raw_sockets is not required.


Example /etc/pf.conf
Code: 
wan = vtnet0
lan = bridge0

nat on $wan from 10.0.0.1/24 to any -> ($wan)

pass in on $lan
pass out keep state
 
I set this but it made no difference.

Could it be a NAT problem?

My /etc/pf.conf:-

Code: 
# Public IP address
IP_PUB="168.235.83.112"

# Packet normalization
scrub in all

# Allow outbound connections from within the jails
nat on vtnet0 from lo1:network to any -> (vtnet0)

# webserver jail at 10.0.0.10
rdr on vtnet0 proto tcp from any to $IP_PUB port 443 -> 10.0.0.10
# just an example in case you want to redirect to another port within your jail
rdr on vtnet0 proto tcp from any to $IP_PUB port 80 -> 10.0.0.10 port 8080


A previous suggestion was this:-
Code: 
#wan = "vtnet0"
#lan = "bridge0"

#nat on $wan from 10.0.0.0/24 to any -> ($wan)

#pass in on $lan
#pass out keep state

so I'm completely confused.
 
balanga said:
A previous suggestion was this:-
Code: 
#wan = "vtnet0"
#lan = "bridge0"
#nat on $wan from 10.0.0.0/24 to any -> ($wan)
#pass in on $lan
#pass out keep state
Click to expand...
Have your tried this pf.conf (un-commented)? Also, it's 10.0.0.1 (bridge0's IP), not 10.0.0.0

After any edit of the file, the pf(4) service has to be restarted.

This pf.conf is a working example in my byhve(8) VM setup (iocage, iocage jails, dnsmasq, pf.conf ).
 
balanga said:
Code: 
# Allow outbound connections from within the jails 
nat on vtnet0 from lo1:network to any -> (vtnet0)
Click to expand...
You used the bridge(4) set up, right? Then it should be:
Code: 
nat on vtnet0 from bridge0:network to any -> (vtnet0)

T-Daemon said:
Also, it's 10.0.0.1 (bridge0's IP), not 10.0.0.0
Click to expand...
He's using a network range; 10.0.0.0/24 which is valid. The .0 is the network address. The rule applies to all source addresses in the 10.0.0.0/24 range.
 
That's because 10.0.0.1/24 and 10.0.0.0/24 are the exact same range (the host bits of the address are irrelevant). That's why you typically use the network address when specifying ranges, to avoid any confusion. If you need a, single, specific IP address, you'd use 10.0.0.1 or 10.0.0.1/32.
 
SirDice said:
That's because 10.0.0.1/24 and 10.0.0.0/24 are the exact same range (the host bits of the address are irrelevant). That's why you typically use the network address when specifying ranges, to avoid any confusion. If you need a, single, specific IP address, you'd use 10.0.0.1 or 10.0.0.1/32.
Click to expand...
/32 rather than /24 ?
 
balanga said:
/32 rather than /24 ?
Click to expand...
If you intent to filter a specific IP address, yes. Compare these two rules:
Code: 
pass in on $int_if from 10.0.0.1/32 to any 
pass in on $int_if from 10.0.0.1/24 to any
The first only allows incoming packets with a specific source IP address of 10.0.0.1. The second allows all source IP addresses in the 10.0.0.0 - 10.0.0.255 range.
 
You must log in or register to reply here.
Back
Top