Questions about iocage

R

rainer_d

Hi,


the ocage documentation says, multiple IP-aliases should come with the "correct" network-mask.
http://iocage.readthedocs.org/en/latest/networking.html#shared-ip

For IP-aliases, I normally use a /32 network-mask.
As described here:
https://www.freebsd.org/cgi/man.cgi?query=ifconfig&sektion=8&manpath=freebsd-release-ports
"If the address is on the same subnet as the first network address for this interface, a non-conflicting netmask must be given. Usually 0xffffffff is most appropriate."


I've got a project were a server has different NICs, which are in sitting on different networks.
To access the DNS-resolvers, the servers requires a route that is on a NIC that doesn't have an IP in any jail.
The jails only have IPs from the "frontend" network, while the route to the resolvers goes through the "backend" NIC.

I'm trying to migrate from ezjail to iocage, which means I have a number of servers setup with ezjail, which I want to complement with servers setup with iocage. All of these servers sit in the same network-segment.

On my ezjail-jails, DNS-resolution works.
On my iocage jails, it doesn't.
Or only for the first jail that starts.

I don't quite understand why this is the case.
 
Turns out (on closer inspection), it doesn't really work in ezjail either and not having an IP on an interface in jail means the route over that interface does not work.
I've setup hosts-file entries for the time being - the jails don't really need to resolve more than two domains (and themselves).
 
I don't have any reference at hand at the moment but at least with FreeBSD 10 and onwards it doesn't matter if you use the same netmask on IPv4 alias addresses (with IPv6 you are forced to use correct prefix length by spec) as the "main" address uses. The documentation is out of date in this regard.
 
You must log in or register to reply here.
Back
Top