IPFW Block external network access but allow internal network access to jailed server.

[Ferocious1881]

Problem description​

I am trying to implement as security model for a VNC jail server of only letting connect to the virtual machine from an ssh tunnel. Which in firewall terms means that only localhost should be able to connect to VNC jail at 10.0.0.10.

I am currently proving the firewall with jexec example sh -c "cd /usr/src; python3 -m http.server", which servers in port 8000.
For all configurations that I have tried, I noticed two things (1) the ipfw rules at the host machine do not affect the communication of the VNET Jail to the rest of the world, and (2) the server at the Jail is either open to the entire world or closed for the entire world.
The current rule is suppossed, but fails to do, to only allow connections from the host, but it would be preferable to filter by blocking connection that do not come for anything in the internal kernel network, as allowing those that are in the internal kernel network.

Jail Configuration​

Have a file called jail.conf with the content:

example {
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown jail";
exec.consolelog = "/var/log/jail_console_${name}.log";

allow.mount;
allow.raw_sockets;
exec.clean;
mount.devfs;
securelevel = 2;
enforce_statfs = 2;
devfs_ruleset = 5;

path = "/jails/${name}";
host.hostname = "${name}";

$unterid = "10";
$id = "${unterid}";
$ip = "10.0.0.${unterid}/24";
$gateway = "192.168.1.1";
$bridge = "bridge0";
$epair = "epair${id}";

vnet;
vnet.interface = "${epair}b";

exec.prestart  = "/sbin/ifconfig ${epair} create up";
exec.prestart += "/sbin/ifconfig ${epair}a up descr jail:${name}";
exec.prestart += "/sbin/ifconfig ${bridge} addm ${epair}a up";
exec.prestart += "/sbin/ifconfig ${epair}a ether 00:00:00:00:00:0a";
exec.prestart += "/sbin/ifconfig ${epair}b ether 00:00:00:00:00:0b";
exec.start    += "/sbin/ifconfig ${epair}b ${ip} up";
exec.start    += "/sbin/route add default ${gateway}";
exec.poststop = "/sbin/ifconfig ${bridge} deletem ${epair}a";
exec.poststop += "/sbin/ifconfig ${epair}a destroy";
}

with the full jail ipfw rules to be:

allow ip from any to any via lo0
deny ip from any to 127.0.0.0/8
deny ip from 127.0.0.0/8 to any
deny ip from any to ::1
deny ip from ::1 to any

check-state :default

allow tcp from any to any 53 out via epair10 setup keep-state :default
allow udp from any to any 53 out via epair10 keep-state :default

allow tcp from 10.0.0.5 to 10.0.0.10 8000 in via epair10 keep-state :default // My best guest

allow log ip from any to any
deny log ip from any to any out via epair10
deny log ip from any to any
count ip from any to any not // orphaned dynamic states counter
deny ip from any to any

and finally setup with

jail -crm -f etc/jail.conf
sysrc -j example firewall_logging="YES"
sysrc -j example firewall_type="closed"
sysrc -j example firewall_script="/etc/ipfw.conf" # where ipfw.conf is full with the previous ipfw rules.
sysrc -j example firewall_enable="YES"
service -j example ipfw status || service -j example ipfw start
service -j example ipfw restart

This assuming you already setup an fresh jail at /jails/example.