Hello...
If you've been following my earlier threads you probably have an idea of what I'm trying to achieve. Chances are you're not so I'll just go ahead and explain.
I have a two FreeBSD machines with three physical interfaces. Each box has two different jails, and each jail has two different virtual interfaces. I use VIMAGE settings to separate the network stacks of the jails.
In order to visualize my scheme, here's an ASCII illustration I put together.
What I wish for is that I want the virtual interfaces within one jail to be able to communicate with each other just fine, and this is done. But I wish tolimit their interaction with the outside. Basically, I want the interface x to always forward traffic to the physical interface em0, and only accept traffic from em0. This means that I cannot reach the IP address of x from msk0. The idea is that any host with the IP 2.2.2.x is able to reach the x (10.0.0.1), but it always have to pass through 2.2.2.2 which is em0.
I understand that I can implement some kind of firewall (I plan to use pf.conf for this, still looking up resources on that), but do I need special routing entries in my routing tables to specifically allow em0 and x to be like "bound" together?
Other than that, and I understand I can google for this it's fine, but perhaps you have something in your bookmarks that I could use, are there any exceptionally helpful PF documentation. The ones I always seem to stumble upon only filter traffic on a machine that has two physical interfaces max, but I have like 5 (not all of them are illustrated). This would be my first time to play with PF, I normally work with iptables.
If you've been following my earlier threads you probably have an idea of what I'm trying to achieve. Chances are you're not so I'll just go ahead and explain.
I have a two FreeBSD machines with three physical interfaces. Each box has two different jails, and each jail has two different virtual interfaces. I use VIMAGE settings to separate the network stacks of the jails.
In order to visualize my scheme, here's an ASCII illustration I put together.
Code:
IP Cipher 1
_______________________
| |
| ______________ |
| | | |
| | JAIL >x<-->em0 <------- { RED NETWORK } -------> 2.2.2.x
| | #1 | | |
| | >i< |
| |______________| \ |
| | |
| | |
| | |
| | |
| \ |
| ( pf ) >msk0 <------- { BLACK NETWORK } -------> 1.1.1.x
| / |
| | |
| | |
| | |
| ______________ | |
| | | / |
| | JAIL >j< |
| | #2 | | |
| | >y<-->em1 <------- { RED NETWORK } -------> 3.3.3.x
| |______________| |
| |
|_______________________|
Physical Interfaces
msk0: IP address 1.1.1.1 (also has a bridge with IP 192.168.1.1 so that JAIL1 and JAIL2 can communicate)
em0: IP address 2.2.2.2
em1: IP address 3.3.3.2
Virtual Interfaces
i: IP address 192.168.1.2
j: IP address 192.168.1.3
x: IP address 10.0.0.1
y: IP address 172.16.0.1What I wish for is that I want the virtual interfaces within one jail to be able to communicate with each other just fine, and this is done. But I wish tolimit their interaction with the outside. Basically, I want the interface x to always forward traffic to the physical interface em0, and only accept traffic from em0. This means that I cannot reach the IP address of x from msk0. The idea is that any host with the IP 2.2.2.x is able to reach the x (10.0.0.1), but it always have to pass through 2.2.2.2 which is em0.
I understand that I can implement some kind of firewall (I plan to use pf.conf for this, still looking up resources on that), but do I need special routing entries in my routing tables to specifically allow em0 and x to be like "bound" together?
Other than that, and I understand I can google for this it's fine, but perhaps you have something in your bookmarks that I could use, are there any exceptionally helpful PF documentation. The ones I always seem to stumble upon only filter traffic on a machine that has two physical interfaces max, but I have like 5 (not all of them are illustrated). This would be my first time to play with PF, I normally work with iptables.