Hi,
Ever since I've upgraded my server from 10.0 to 10.1 my (one and only) jail is having problems accessing the main host. After some time - can be hours or days - it fails to establish a connection to the main host. E.g. Roundcube webmail can't access the IMAP server, a SSH login to the main host hangs/times out. All I've done is to migrate from 10.0 to 10.1 and the jail configuration from rc.conf to the jail.conf.
My setup: 192.168.1.1 (server), 192.168.1.5 (jail)
I was thinking that maybe there are too many open connections or that the system has run out of sockets, but both
jail.conf:
Anyone has any idea what might be the problem? I'm guessing that something must be wrong with my configuration as I didn't find anything similar so far... And it must only be affecting the internal networking between the host and the jail as the jail can communicate with any other machine just fine.
Ever since I've upgraded my server from 10.0 to 10.1 my (one and only) jail is having problems accessing the main host. After some time - can be hours or days - it fails to establish a connection to the main host. E.g. Roundcube webmail can't access the IMAP server, a SSH login to the main host hangs/times out. All I've done is to migrate from 10.0 to 10.1 and the jail configuration from rc.conf to the jail.conf.
My setup: 192.168.1.1 (server), 192.168.1.5 (jail)
Code:
[jail] ~> fetch -o /dev/null http://www.google.ch
fetch: http://www.google.ch: size of remote file is not known
/dev/null 18 kB 1932 kBps 00m00s
[jail] ~> ping -c 1 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=57 time=7.252 ms
--- 8.8.8.8 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 7.252/7.252/7.252/0.000 ms
[jail] ~> ssh user@server
ssh_exchange_identification: read: Operation timed out
[jail] ~> truss -af ssh ssh@192.168.1.1
--snip--
47260: socket(PF_INET,SOCK_STREAM,6) = 3 (0x3)
--snip--
47260: sigaction(SIGPIPE,0x0,{ SIG_DFL 0x0 ss_t }) = 0 (0x0)
47260: sigaction(SIGPIPE,{ SIG_IGN 0x0 ss_t },0x0) = 0 (0x0)
47260: sigaction(SIGCHLD,0x0,{ SIG_DFL 0x0 ss_t }) = 0 (0x0)
47260: sigaction(SIGCHLD,{ 0x40b480 0x0 ss_t },0x0) = 0 (0x0)
47260: write(3,"SSH-2.0-OpenSSH_6.4_hpn13v11 Fre"...,47) = 47 (0x2f)
--hangs until "Operation timed out"--
[jail] ~> uname -a
FreeBSD jail.lan 10.1-STABLE FreeBSD 10.1-STABLE #29: Sun Mar 8 19:57:45 CET 2015 root@server.local.lan:/usr/obj/usr/src/sys/Kernel amd64 netstat -an and sysctl kern.ipc.numopensockets show only a very moderate amount of open connections/sockets.jail.conf:
Code:
allow.raw_sockets = 1;
exec.clean;
exec.system_user = "root";
exec.jail_user = "root";
exec.start += "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.consolelog = "/var/log/jail_${name}_console.log";
mount.devfs;
#mount.procfs;
allow.mount;
allow.set_hostname = 1;
allow.sysvipc = 1;
path = "/jails/${name}";
inet {
host.hostname = "jail";
path = "/usr/jails/inet";
interface = "em0";
ip4.addr += "em0|192.168.1.5/32";
}
Last edited by a moderator:
The connections do not work again until the jail is restarted (which isn't always successful, sometimes the restart command hangs). I do not filter my loopback in any way. I've switched back from /etc/jail.conf to /etc/rc.conf for the jail configuration, the jail has proven to be stable ever since. So I'm suspecting that maybe it has something to do with the configuration.... Will report back with further tests and or an update. Thanks for the 
, my current list of enabled services on the main host:
). Anyone knows what's going on?