Solved Isolate jails from each others

S

sompi

Hello, i have a FreeBSD server with 2 network interfaces: external have one public IP and internal have one internal IP.
This server also have one jail which share public ip with the host system and another jail which share internal ip with host system.
Host system have PF firewall and will be gateway (and NAT) for internal network.
I need to block all traffic from jail with public IP to internal network and jail with internal ip.
How to do this? Maybe i should give "internal" jail another internal ip and try to block connection to interface with PF, but i think traffic from one jail to another doesn't go through the interface so can't be blocked with PF?
Thanks.
 
Hm i guess rule like:
Code: 
        block from $Public_ip to $Internal_net
will be ok.
But i need to turn off skipping on lo0 in PF
 
I have had the experience that firewalling with jails is much easier with vnet enabled jails, maybe have a look at that ... so you can use "localhost" like the normal way and you can implement simple pf rules on the host side (and even inside the jails)
 
You must log in or register to reply here.
Back
Top