Solved Accessing a web server in a jail

balanga said:
jiggling about with /etc/pf.conf ?
Click to expand...
Or IPFW, whatever you prefer.

There's only one downside to using regular port forwarding, you can only forward ports 80/443 once. But if you only have one web server it's a fine solution.
 
SirDice said:
Or IPFW, whatever you prefer.

There's only one downside to using regular port forwarding, you can only forward ports 80/443 once. But if you only have one web server it's a fine solution.
Click to expand...

In https://www.davd.io/posts-freebsd-jails-with-a-single-public-ip-address/

it suggests the parameters below, do they look reasonable for the webserver jail?

Obviously after changing em0 to vtnet0 and the IP addresses.


SirDice said:
Code: 
# Public IP address

IP_PUB="1.2.3.4"

# Packet normalization
scrub in all

# Allow outbound connections from within the jails
nat on em0 from lo1:network to any -> (em0)

# webserver jail at 192.168.0.2
rdr on em0 proto tcp from any to $IP_PUB port 443 -> 192.168.0.2
# just an example in case you want to redirect to another port within your jail
rdr on em0 proto tcp from any to $IP_PUB port 80 -> 192.168.0.2 port 8080

# mailserver jail at 192.168.0.3
rdr on em0 proto tcp from any to $IP_PUB port 25 -> 192.168.0.3
rdr on em0 proto tcp from any to $IP_PUB port 587 -> 192.168.0.3
rdr on em0 proto tcp from any to $IP_PUB port 143 -> 192.168.0.3
rdr on em0 proto tcp from any to $IP_PUB port 993 -> 192.168.0.3
Click to expand...
 
The david.io article is using it as an example. Your provider should have given you the public IP address. Then you can use, as that david.io article says, a private network such as 192.168.0.x for the jail.
 
scottro said:
The david.io article is using it as an example. Your provider should have given you the public IP address. Then you can use, as that david.io article says, a private network such as 192.168.0.x for the jail.
Click to expand...
So using the article and just changing the addresses and the interface name from em0 to vtnet0 should suffice?
 
I believe so. Change em0 to vtnet0, use the public address of your VPS, then you can follow the article as written, that is, clone lo1 (which I keep saying in my head as LOL) to the internal addresses and use rdr as shown. I *think* letsencrypt if you're using it for the site, may need port 80 to work as well, on my own pf I have
Code: 
 WEBPORT="{ 80, 443 }"
and
Code: 
rdr pass on re0 proto tcp from any to $IP_PUB port $WEBPORT -> $WEBJAIL
 
Code: 
$ext_if="vtnet0"

rdr on $ext_if proto tcp from any to ($ext_if) port $WEBPORT -> $WEBJAIL

pass in on $ext_if from any to $WEBJAIL port $WEBPORT
The reason for splitting it up into separate rdr and pass rule is because rdr pass will "short-circuit", the traffic is always passed and any other rule is entirely ignored (so you can never block any "bad" traffic).
 
scottro said:
I believe so. Change em0 to vtnet0, use the public address of your VPS, then you can follow the article as written, that is, clone lo1 (which I keep saying in my head as LOL) to the internal addresses and use rdr as shown.
Click to expand...

I thought lo1 was a mistake. I have never seen anything like this mentioned before.
 
I'm very confused (what's new).

I have two threads which are basically about the same thing, ie accessing a VPS host jail from the Internet and vice verse.

I can ping out from the host's jail, but cannot access a webserver in that jail.

I get

This site can’t be reached​



This response only occurs when the webserver is in the jail. When it runs diectly on the host I get

'It works!'

The question is, do I need to configure the webserver differently when in a jail, or do I need to change pf.conf to accommodate access to the jail from the Internet?
 
balanga said:
The question is, do I need to configure the webserver differently when in a jail, or do I need to change pf.conf to accommodate access to the jail from the Internet?
Click to expand...
The second. By configuring the web-server you will never make a local IP public accessible.
You can also run a second web server, this time nginx, outside, and configure it as proxy.
Or just run everything outside, perhaps chrooted, and of course as unprivileged user.
I never in my life used a jail.
 
This /etc/pf.conf seems to work both ways.



Code: 
ext_if = "vtnet0"
jail_ip = "10.0.0.10"          # ← change to your jail’s IP
web_ports = "{ 80, 443 }"

# NAT for the whole jail network (so the jail can reach the internet)
nat on $ext_if from 10.0.0.0 to any -> ($ext_if)

# Redirect incoming web traffic to the jail
rdr on $ext_if proto tcp from any to ($ext_if) port $web_ports -> $jail_ip

# Allow the traffic
pass in on $ext_if proto tcp to $jail_ip port $web_ports
pass out all
pass in on bridge0


Any comments?
 
You must log in or register to reply here.
Back
Top