FreeBSD 10.0 jail

[Ignatz]

Hello, everyone!

Is there any way to create a jail with two netwotk interfaces in it?

 

[Crest]

Your question is imprecise. If you're asking whether it is possible to assign a single jail IP addresses from multiple interfaces in jail.conf then the answer is yes. The syntax is to use = for the first assignment and += for the other assignments.

 

[Ignatz]

I'm sorry for the lack of info, I'll try to be more precise.

jail.conf

foo {
        path = /jail/foo;
        host.hostname = foo;
        ip4.addr = 192.168.1.5, 10.10.10.5;
        mount.devfs;
        devfs_ruleset = 4;
        exec.start = "/bin/sh /etc/rc";
        exec.stop = "/bin/sh /etc/rc.shutdown";
        jid = 3;
        allow.raw_sockets=1;
}

So if I ping from jail to machine bar with address 10.10.10.6 -> I'm getting this on bar

[root@host1 ~]# tcpdump -i bge0 | grep ICMP
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bge0, link-type EN10MB (Ethernet), capture size 65535 bytes
15:06:21.242854 IP 192.168.1.5 > 10.10.10.6: ICMP echo request, id 63319, seq 7, length 64
15:06:22.243944 IP 192.168.1.5 > 10.10.10.6: ICMP echo request, id 63319, seq 8, length 64
15:06:23.245003 IP 192.168.1.5 > 10.10.10.6: ICMP echo request, id 63319, seq 9, length 64

[root@src4 ~]# tcpdump -i bge1 | grep ICMP
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bge1, link-type EN10MB (Ethernet), capture size 65535 bytes
15:10:21.492931 IP 10.10.10.6 > 192.168.1.5: ICMP echo reply, id 63319, seq 247, length 64
15:10:22.493902 IP 10.10.10.6 > 192.168.1.5: ICMP echo reply, id 63319, seq 248, length 64

It looks like traffic on this machine from jail1 if going in through bge0 interface and going out through bge1. I suppose it happens because all traffic from jail going out from the first address in ip4.addr string
Can I somehow change that jail behavior?

 

[asteriskRoss]

Hi @Ignatz, it should be possible to do what you want. It sounds like at present, the alias IP addresses are being associated with the wrong interface. You should be able to see the aliases associated with each interface by running ipconfig -a in the host. Can you post the output?

The man page for jail(8) describes how to associate IP aliases with an interface when the jails start:

Jail Parameters
[...]
Other parameters may have more than one value,
specified as a comma-separated list or with ``+='' in the configuration
file (see jail.conf(5) for details).
[...]
interface
A network interface to add the prison's IP addresses (ip4.addr
and ip6.addr) to. An alias for each address will be added to the
interface before the prison is created, and will be removed from
the interface after the prison is removed.

ip4.addr
In addition to the IP addresses that are passed to the kernel,
and interface and/or a netmask may also be specified, in the form
``interface|ip-address/netmask''. If an interface is given
before the IP address, an alias for the address will be added to
that interface, as it is with the interface parameter. If a net-
mask in either dotted-quad or CIDR form is given after IP
address, it will be used when adding the IP alias.

So I believe the following (untested) configuration adapted from the /etc/jail.conf you posted should do what you need, assuming I've guessed your desired interface/IP address associations correctly:

foo {
        path = "/jail/foo";
        host.hostname = "foo";
        ip4.addr = "bge0|192.168.1.5";
        ip4.addr += "bge1|10.10.10.5";
        mount.devfs;
        devfs_ruleset = "4";
        exec.start = "/bin/sh /etc/rc";
        exec.stop = "/bin/sh /etc/rc.shutdown";
        jid = "3";
        allow.raw_sockets = "1";
}