Solved IPFW breaks jail networking

C

cfw

Whenever I reboot with ipfw enabled my iocage (VNET) jails aren't able to network.

Fetch and ping return Permission denied.

I've got this in my rc.conf related to ipfw and natd:
Code: 
firewall_enable="YES"
firewall_type="open"
firewall_script="/etc/ipfw.rules"
gateway_enable="YES"
natd_enable="YES"

/etc/ipfw.rules is stripped down to allow all from any to any.

What's going on here?
 
Do not use both firewall_type and firewall_script. The second rips the rug out from under the first, although I'm not sure that's the problem here.
 
  • Thanks
Reactions: cfw
I've removed firewall_script="/etc/ipfw.rules" from my /etc/rc.conf.

The problem still persists.

ping 192.168.10.1 returns ping: sendto: Permission denied.
Similarly fetch and host fail within jails.

This also occurs when I disable ipfw with service ipfw stop and without gateway_enable="YES" and natd_enable="YES" in /etc/rc.conf.

Even nc -l 3232 is unable to connect to nc 127.0.0.1 3232 within a jail.
 
You must log in or register to reply here.
Back
Top