I am using jails for an emulation task. Each jail has its own IP, and each node hosting jails has its own IP which is not used by a jail. Sometimes I want to redirect traffic intended for a jail to the host node where jail is running. I use ipfw_nat for that. The IPFW ruleset roughly looks like:
1. Allow all traffic to a jail on a port belonging to something being emulated
2. Direct all other traffic to a NAT that translates to the host node address
For some reason this allows traffic to jails running on other nodes, but traffic intended for jails running on the same physical interface end up not matching rule 1, and get NAT'd. I notice if I have a big catchall rule before the NAT redirect like:
Then things work. Why is that? How can I get such filtering on specific ports? Is there another approach you could suggest?
Here is a specific example ruleset, pruned a bit for relevancy:
The NATs are:
The interface corresponds to an Infiniband card, though I'm not sure if that is relevant:
1. Allow all traffic to a jail on a port belonging to something being emulated
2. Direct all other traffic to a NAT that translates to the host node address
For some reason this allows traffic to jails running on other nodes, but traffic intended for jails running on the same physical interface end up not matching rule 1, and get NAT'd. I notice if I have a big catchall rule before the NAT redirect like:
Code:
ipfw add allow all from me to me keep-state
Then things work. Why is that? How can I get such filtering on specific ports? Is there another approach you could suggest?
Here is a specific example ruleset, pruned a bit for relevancy:
Code:
00300 allow ip from any to 169.254.228.82 dst-port 65456 keep-state
00400 allow ip from any to 169.254.228.86 dst-port 65456 keep-state
00500 nat 1001 ip from any to 169.254.228.82 keep-state
00600 nat 3001 ip from any to 169.254.228.86 keep-state
65535 allow ip from any to any
The NATs are:
Code:
ipfw nat 3001 config ip 1.111.228.82 same_ports
ipfw nat 1001 config ip 1.111.228.82 same_ports
The interface corresponds to an Infiniband card, though I'm not sure if that is relevant:
Code:
ib1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 2044
options=80018<VLAN_MTU,VLAN_HWTAGGING,LINKSTATE>
lladdr 0.0.4.6.fe.80.0.0.0.0.0.0.0.15.1b.0.10.81.c.df
inet 1.111.228.82 netmask 0xffff0000 broadcast 1.111.255.255 zone 1
inet 169.254.228.82 netmask 0xffff0000 broadcast 169.254.255.255 zone 1
inet 169.254.228.86 netmask 0xffff0000 broadcast 169.254.255.255 zone 1
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
media: Infiniband autoselect
status: active