I usually enjoy learning by doing, however, this is somehow a production server (people need it running). I’m in hurry to help my friend and I already managed to lock out myself once. Please help.
The goal is to have a jail for an untrusted user. The host is directly connected to the internet. The host has a single public IP address (nothing like 192.168.x.x), which I will replace to 199.199.199.199 for security reasons.
The jail should:
* See the internet
* Run Apache
* Be reachable via ssh on the host’s IP (on other port than 22)
* See the host’s MySQL server (TCP/IP will be fine)
* Be safe
The host also runs Apache so I need reverse proxy setup instead of port forwarding. The host uses ipfw. I’m not asking how to configure Apache or MySQL, the sole issue is the networking part.
At the beginning I found two links:
http://www.bsdnow.tv/tutorials/jails
https://www.freebsd.org/doc/handbook/jails-ezjail.html
I went with the latter as I felt it more secure, even though I have little idea about aliasing Ethernet interfaces.
Host’s /etc/rc.conf:
/usr/local/etc/ipfw.rules:
The jail’s /etc/hosts:
I’ve commented out the ipv6 part since I had no better idea.
At this point the jail doesn’t see the internet. I’m aware that ping shouldn’t work and it’s nothing to do with the resolv.conf since I try to
There is nothing in the jail’s rc.conf yet.
I would like to understand whether I need NAT at this point. I guess I’ll need it anyway to reach the jail from outside via ssh, however, do I need it also to see the internet from the jail?
I read this too: https://forums.freebsd.org/threads/howto-quick-setup-of-jail-on-zfs-using-ezjail-with-pf-nat.30063/
I haven’t tried as I’m not a network expert and I would like to understand what I am doing instead of copying dozens of lines into the config files when I don’t necessarily need them. I would like to keep it as simple as possible.
However, I tried:
on the host. It didn’t help.
Finally I added this to the rc.conf on the host:
No luck. By the way I see nothing in the firewall log regarding to the outgoing ssh attempts.
Please tell:
* Whether I really need NAT for outgoing connections from the jail.
* How to make a minimal config to forward the host’s 1022 port to the jail’s 22 port via ipfw.
I also think that the host’s and the jail’s sshd are fighting for the 192.168.1.244 IP’s ssh port with the default config (bound to all interfaces).
The goal is to have a jail for an untrusted user. The host is directly connected to the internet. The host has a single public IP address (nothing like 192.168.x.x), which I will replace to 199.199.199.199 for security reasons.
The jail should:
* See the internet
* Run Apache
* Be reachable via ssh on the host’s IP (on other port than 22)
* See the host’s MySQL server (TCP/IP will be fine)
* Be safe
The host also runs Apache so I need reverse proxy setup instead of port forwarding. The host uses ipfw. I’m not asking how to configure Apache or MySQL, the sole issue is the networking part.
At the beginning I found two links:
http://www.bsdnow.tv/tutorials/jails
https://www.freebsd.org/doc/handbook/jails-ezjail.html
I went with the latter as I felt it more secure, even though I have little idea about aliasing Ethernet interfaces.
ezjail-admin create oi 'lo1|127.0.1.1,em0|192.168.1.244'
Code:
# ifconfig
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=4219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC,VLAN_HWTSO>
ether 00:30:48:f6:45:d0
inet 199.199.199.199 netmask 0xffffff80 broadcast 199.199.199.198
inet 192.168.1.244 netmask 0xffffffff broadcast 192.168.1.244
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
inet 127.0.0.1 netmask 0xff000000
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
lo1: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
inet 127.0.1.1 netmask 0xffffffff
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
Code:
ifconfig_em0="inet 199.199.199.199 netmask 255.255.255.128 broadcast 199.199.199.198"
defaultrouter="199.199.199.197"
# Firewall
firewall_enable="YES"
firewall_script="/usr/local/etc/ipfw.rules"
# Ezjail
ezjail_enable="YES"
cloned_interfaces="${cloned_interfaces} lo1"
Code:
# set command
IPF="ipfw -q add"
# clear
ipfw -q -f flush
#loopback
$IPF 10 allow all from any to any via lo0
$IPF 20 deny all from any to 127.0.0.0/8
$IPF 30 deny all from 127.0.0.0/8 to any
$IPF 40 deny tcp from any to any frag
# statefull
$IPF 50 check-state
$IPF 60 allow tcp from any to any established
$IPF 70 allow all from any to any out keep-state
$IPF 80 allow icmp from any to any
# open port ftp (20,21), ssh (22), mail (25)
# http (80), dns (53) etc
$IPF 110 allow tcp from any to any 21 in
$IPF 120 allow tcp from any to any 22 in
$IPF 130 allow tcp from any to any 25 in
$IPF 140 allow udp from any to any 53 in
$IPF 150 allow tcp from any to any 53 in
$IPF 160 allow tcp from any to any 80 in
$IPF 170 allow tcp from any to any 143 in
$IPF 180 allow tcp from any to any 465 in
$IPF 190 allow tcp from any to any 993 in
# allow any out
$IPF 400 allow all from any to any out
# deny and log everything
$IPF 500 deny log all from any to any
Code:
#::1 localhost oi.my.domain oi
127.0.1.1 localhost oi.my.domain oiAt this point the jail doesn’t see the internet. I’m aware that ping shouldn’t work and it’s nothing to do with the resolv.conf since I try to
ssh <another-server-reachable-from-the-host-and-anywhere>, and it waits forever inside the jail. Same about installing pkg or telnet <whatever> 80.There is nothing in the jail’s rc.conf yet.
I would like to understand whether I need NAT at this point. I guess I’ll need it anyway to reach the jail from outside via ssh, however, do I need it also to see the internet from the jail?
I read this too: https://forums.freebsd.org/threads/howto-quick-setup-of-jail-on-zfs-using-ezjail-with-pf-nat.30063/
I haven’t tried as I’m not a network expert and I would like to understand what I am doing instead of copying dozens of lines into the config files when I don’t necessarily need them. I would like to keep it as simple as possible.
However, I tried:
/etc/rc.d/ipfw stopon the host. It didn’t help.
Finally I added this to the rc.conf on the host:
Code:
gateway_enable="YES"
natd_enable="YES"
natd_interface="em0"
natd_flags="-dynamic -m"
firewall_nat_enable="YES"No luck. By the way I see nothing in the firewall log regarding to the outgoing ssh attempts.
Please tell:
* Whether I really need NAT for outgoing connections from the jail.
* How to make a minimal config to forward the host’s 1022 port to the jail’s 22 port via ipfw.
I also think that the host’s and the jail’s sshd are fighting for the 192.168.1.244 IP’s ssh port with the default config (bound to all interfaces).
