Solved Manual network setup required for Bastille jails?

[janedenone]

I configured a Bastille VNET jail for the first time recently, and except for a stupid mistake, it worked quite well after I added IPs (IPv4/IPv6) from the jail's IP subnet to the bridge interface, and defined these IPs as default gateways for the jail. The latter can be accomplished via /usr/local/bastille/bastille.conf with the bastille_network_gateway and bastille_network_gateway6 variables. The former step had to be done manually (with ifconfig), and appending /etc/rc.conf like this –

ifconfig_vtnet0bridge=10.95.0.1/24
ifconfig_vtnet0bridge_ipv6="inet6 fdb6:1b5:3992:e964::1/64"

– did not achieve persistence, because the interface exists only after Bastille starts.

How can I make the IP addresses stick to the bridge, why is there no (obvious) way to configure the bridge interface automatically (using Bastille), and am I using VNET jails completely wrong?

Update: I used devd with the following configuration –

notify 100 {
    match "system" "IFNET";
    match "subsystem" "bridge0";
    match "type" "LINK_UP";
    action "sleep 2; ifconfig vtnet0bridge inet 10.95.0.1/24; ifconfig vtnet0bridge inet6 fdb6:1b5:3992:e964::1/64";
};

– for a persistent IP assignment now, but I am still hoping for something more elegant.

 

[janedenone]

I should have read the Bastille documentation properly: Bridged VNET jails are what I want, along with a bridge defined in /etc/rc.conf:

cloned_interfaces="bridge0"
ifconfig_bridge0_name="bastille0"
ifconfig_bastille0="addm vtnet0 up"
ifconfig_bastille0=10.95.0.1/24
ifconfig_bastille0_ipv6="inet6 fdb6:1b5:3992:e964::1/64"

Converting an existing VNET jail requires the following change in /usr/local/bastille/jails/dbjail/jail.conf

vnet;
vnet.interface = e0b_dbjail;

# VNET config (old)
#exec.prestart += "jib addm dbjail vtnet0";
#exec.prestart += "ifconfig e0a_dbjail description \"vnet0 host interface for Bastille jail dbjail\"";

# Bridged VNET config (new)
exec.prestart += "epair0=\$(ifconfig epair create) && ifconfig \${epair0} up name e0a_dbjail && ifconfig \${epair0%a}b up name e0b_dbjail";
exec.prestart += "ifconfig bastille0 addm e0a_dbjail";
exec.prestart += "ifconfig e0a_dbjail description \"vnet0 host interface for Bastille jail dbjail\"";

exec.poststop += "ifconfig e0a_dbjail destroy";