Solved Jail Connection Randomly Drops

Hello everyone,

I recently did a clean install of 10.3-RELEASE on my home server. I set up a jail and was puzzled to find that the jail's connection to the internet would randomly drop and would only be fixed by a restart of the jail from the host. The host system would never lose connection. I could not find anything in /var/log/messages that indicated why the connection dropped, so I left the issue and came back to it a few days later.

Once I started investigating it again, I found that when the connection went down, I would get kicked from ssh(8) connections established from outside the network and when I would try to reconnect, sshd(8) would refuse the connection. The strange thing is that if I try to ssh(8) to the jail from inside the network, while the connection is very slow (it takes about 15 seconds just to get to login(1)), it works. In addition to this, the only system I can ping from the jail is the host.

Here is my host's rc.conf:
Code:
#Network
hostname="freebsd-server.home.net"
ifconfig_em0="inet 192.168.1.10 netmask 255.255.255.0"
# Clone of em0 for jails
ifconfig_em0_alias0="inet 192.168.1.11 netmask 255.255.255.0"
defaultrouter="192.168.1.1"

sshd_enable="YES"

ntpd_enable="YES"

# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="AUTO"
and the jail.conf:
Code:
# Global settings
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.clean;
mount.devfs;

test_jail {
  host.hostname = "server.home.net";
  path = "/usr/local/jails/test_jail";
  interface = "em0";
  ip4.addr = 192.168.1.11;
  # For testing purposes
  allow.raw_sockets;
}

Both the host and the jail are running 10.3-RELEASE-p2. The jail was installed with bsdinstall(8). I'm sure that no other device on the network has 192.168.1.11 as its IP. I'm very confused as to why this is happening. Has anyone else experienced this issue before?
 
Why are you creating the 192.168.1.11 address on both the host and the jail? That is likely to be a problem.
 
Hi wblock@,

I was following the network configuration section of this BSD Now tutorial, which created the address on both the host and the jail. Removing the alias from my rc.conf had no effect, but I did discover that after a fresh reboot of the host, the first start of the jail results in a very slow connection in the jail and sendmail(8) takes about 30 seconds to start. This does not happen on subsequent restarts of the jail however.
 
Slow jail start like that is usually a hostname resolution problem, the jail's hostname should be resolvable trough the jails /etc/hosts. For example if the hostname for the jail is jail1.home.net you would add this to the jail's /etc/hosts:

Code:
192.168.1.11 jail1.home.net
 
kpa
Adding the jail's hostname to /etc/hosts made sendmail(8) start up at the same speed on the first boot as it does on any other reboot of the jail. I'm not sure as to why there is a hostname resolution problem however, as my host server did not need any modifications to /etc/hosts in order to start sendmail(8) quickly.

Unfortunately, the overall problem still remains with the jail losing its connection to the internet after a period of time. I also made a new discovery today. When I started this thread, I had port 11022 forwarded on my router so that I could access the jail. When the jail lost connection to the internet, I was still able to SSH to it from the local network, but trying to access it from outside through the forwarded port on my router resulted in sshd(8) refusing the connection. Today I removed the forwarded port from my router and I am no longer able to connect to the machine from inside the network when the jail loses its connection. I'm pretty confused as to why I'm having all of these problems with jails when the host's connection is fine. I was able to get jail networking running smoothly on 10.2-RELEASE using what I think is the same configuration (though I may have done something different when I configured the jail on my current installation).
 
Well I feel pretty stupid now. I completely forgot that my Raspberry Pi existed and had the same IP as the one I assigned to the jail. Changing the jail's IP to not conflict with the Raspberry Pi solved the issue.
 
Back
Top