IOCAGE on a VPS

Don't know, doesn't iocage have something builtin? You might need to configure that to listen on the bridge interface and serve 10.0.0.0/24 addresses.
 
Here is what I have in my IOCAGE log file when I start my TEST jail.

Can anyone shed any light on what is wrong? I have installed dnsmasq on the host assuming it would provide an IP address to this jail but it doesn't seem to.

Code: 
Starting dhclient.
Starting Network: lo0 epair0b.
lo0: flags=1008049<UP,LOOPBACK,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 16384
        options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
        inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
        groups: lo
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
epair0b: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        options=60001b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,RXCSUM_IPV6,TXCSUM_IPV6>
        ether fa:16:3e:2d:ff:20
        hwaddr 58:9c:fc:10:d5:2c
        inet6 fe80::f816:3eff:fe2d:ff20%epair0b prefixlen 64 scopeid 0x6
        groups: epair
        media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
        status: active
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
Waiting 30s for the default route interface: .............................





add host 127.0.0.1: gateway lo0 fib 0: route already in table
add host 127.0.0.1: gateway lo0 fib 0: route already in table
add host 127.0.0.1: gateway lo0 fib 0: route already in table
add host 127.0.0.1: gateway lo0 fib 0: route already in table
add host 127.0.0.1: gateway lo0 fib 0: route already in table
add host 127.0.0.1: gateway lo0 fib 0: route already in table
add host ::1: gateway lo0 fib 0: route already in table
add net fe80::: gateway ::1
add net ff02::: gateway ::1
add net ::ffff:0.0.0.0: gateway ::1
add net ::0.0.0.0: gateway ::1
 
SirDice said:
Assign a static IP address, for example 10.0.0.2/24, to the jail.
Click to expand...
balanga said:
How do I do that?

Do I need to install a DHCP server (dnsmasq) on my host?
Click to expand...
You don't need a DHCP server to assign a static IP to a (iocage) jail, the IP address of the jail can be set in two ways:

1. https://iocage.readthedocs.io/en/latest/networking.html#vimage-vnet
Configure an IP address

Code: 
iocage set ip4_addr="vnet0|10.1.1.10/24" examplejail
Click to expand...

2. Edit manually jails config.json, for example ../iocage/jails/<jail_name>/config.json:
Rich (BB code): 
   - "dhcp": on,
   + "ip4_addr": "x.x.x.x",

balanga said:
I have installed dnsmasq on the host assuming it would provide an IP address to this jail but it doesn't seem to.
Click to expand...
Show us /usr/local/etc/dnsmasq.conf, it might be miss-configured.
 
The problem of your VPS network setup is connecting the jails to the internet over a bridge(4), over a network interface with a public IP.

You need to connect the bridge ("bridge0") to the internet facing network interface "vtnet0" with the pf(4) packet filter (NAT, as SirDice
addviced).
SirDice said:
You cannot bridge your jails with your external interface on your VPS. You do need a bridge (to attach your jails to) but it'll be disconnected from your external interface, so this "network" will be entirely local. Then you set up NAT and such so your jails can connect to the outside world.
Click to expand...

pf(4) not being my forte, I asked https://chatgpt.com, got a working solution (I corrected some unnecessary settings, the VPS is simulated in a bhyve(8) VM. IP addresses I used are in the 192.168.x.x range):

Network topology (copy&paste from chatgpt):
Code: 
                     Internet
                        |
                   168.235.83.1
                        |
                  +-------------+
                  |   vtnet0    |
                  |168.235.83.112
                  +-------------+
                        |
                   FreeBSD Host
                   IP Forwarding
                        |
                  +-------------+
                  |   bridge0   |
                  | 10.0.0.1/24 |
                  +-------------+
                     |      |
                 epair0a  epair1a
                    |        |
              +-----------+ +-----------+
              | epair0b   | | epair1b   |
              |10.0.0.2   | |10.0.0.3   |
              +-----------+ +-----------+
                 Jail 1        Jail 2

VPS host configuration:

/etc/rc.conf
Code: 
defaultrouter="168.235.83.1"
gateway_enable="YES"

ifconfig_vtnet0="inet 168.235.83.112/24"

cloned_interfaces="bridge0"
ifconfig_bridge0="inet 10.0.0.1/24 up"

dnsmasq_enable="YES"

/etc/pf.conf (I haven't reviewed the settings in detail):
Code: 
wan = "vtnet0"
lan = "bridge0"

nat on $wan from 10.0.0.0/24 to any -> ($wan)

pass in on $lan
pass out keep state
service pf enable
service pf start

Jail configuration:
Code: 
# iocage set bpf=1 <jail>
# iocage set dhcp=1 <jail>
# iocage set vnet=1 <jail>
A "defaultrouter" (bridge0 IP) needs to be set to the jail , but on my setup following setting has no effect:
Code: 
# iocage set defaultrouter=10.0.0.1 <jail>

I configured the jails /etc/rc.conf manually.

../iocage/jails/<jail>/root/etc/rc.conf
Code: 
defaultrouter="10.0.0.1"


In case you want to ask a AI about this specific setup, ask as follows:

Show me a FreeBSD host network configuration with a internet facing network interface named vtnet0 and public address 168.235.83.112, defaultrouter of vtnet0 has address 168.235.83.1, a bridge(8) named bridge0 with address 10.0.0.1 , connecting vnet jails.
 
I don’t understand why there is a need for VNET jails. VNET jails have their own network stack and therefore act as a separate machine on the network. Off you have only a single public IP, then what you need is a NAT jail.

Unless Iocage doesn’t offer those types of jails.
 
victort said:
I don’t understand why there is a need for VNET jails.
Click to expand...

The guide in post # 30 was formulated assuming, that the user want's to use a DHCP server to assign a static IP based on the MAC address of the jail (see Thread how-to-get-a-hostname-for-a-jail.103299, post #6). "Host Networking Mode" (IP Sharing) doesn't provide a MAC address, only virtual networks (VNET).

balanga, if that is not the case, please inform us (perhaps I should have asked that earlier).
 
T-Daemon said:
The guide in post # 30 was formulated assuming, that the user want's to use a DHCP server to assign a static IP based on the MAC address of the jail (see Thread how-to-get-a-hostname-for-a-jail.103299, post #6). "Host Networking Mode" (IP Sharing) doesn't provide a MAC address, only virtual networks (VNET).

balanga, if that is not the case, please inform us (perhaps I should have asked that earlier).
Click to expand...
On my home network I use

iocage create -r latest -p ./$JAIL.json -n $JAIL vnet=on dhcp=on

That works fine, presumably because I have a dhcp server (dnsmasq) on my network.

I thought that installing dnsmasq on my VPS host would have the same effect, but I can't work out whether it is impossible or I have not yet found the correct magic lines.

On my home system where jails are installed I have:

ifconfig_em0="DHCP"
cloned_interfaces="bridge0"
ifconfig_bridge0="addm em0 up"
Click to expand...
On my VPS I have used a static IP. em0 is not relevant there.
 
You must log in or register to reply here.
Back
Top