Hello folks,
this is my first attempt configuring a jail using VNET. Previously I have always used to deploy jails using alias of the external interface.
So, I took this /etc/jail.conf from a user on reddit, and based on my understanding it does(should do) the following:
1. A bridge is created between the $uplink(ext inf) and epairXa interfaces
2. epairXb interfaces are added to the jails and named jail0 inside each jail
3. The jail on (jail0)epairXb should be reachable from the host through bridge0 as both epairXa and uplink interface have been added to it
Output of
/etc/rc.conf in www jail
ifconfig from the jail
Pinging the host from the www jail will return a Network is unreachable error. Interestingly, when pining the www jail from the host, the ping is stuck. A traceroute shows the host goes all the way down to my router to find 192.168.60.0/24 and than dies
Even adding a static route inside the www jail won't help resolving the host. Where am I doing wrong? I am really not good at networking.
Thanks
this is my first attempt configuring a jail using VNET. Previously I have always used to deploy jails using alias of the external interface.
So, I took this /etc/jail.conf from a user on reddit, and based on my understanding it does(should do) the following:
1. A bridge is created between the $uplink(ext inf) and epairXa interfaces
2. epairXb interfaces are added to the jails and named jail0 inside each jail
3. The jail on (jail0)epairXb should be reachable from the host through bridge0 as both epairXa and uplink interface have been added to it
Code:
# Global settings applied to all jails.
exec.system_user = "root";
exec.jail_user = "root";
mount.devfs;
allow.raw_sockets;
devfs_ruleset = "5";
# Networking and the exec cycle
$uplinkdev = "vtnet0";
vnet;
vnet.interface = "jail0"; # default vnet interface
exec.prestart = "ifconfig bridge0 > /dev/null 2> /dev/null || ( ifconfig bridge0 create up && ifconfig bridge0 addm $uplinkdev )";
exec.prestart += "ifconfig $epair create up || echo 'Skipped creating epair (exists?)'";
exec.prestart += "ifconfig bridge0 addm ${epair}a || echo 'Skipped adding bridge member (already member?)'";
exec.created = "ifconfig ${epair}b name jail0 || echo 'Skipped renaming ifdev to jail0 (looks bad...)'";
exec.clean;
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.poststop = "ifconfig bridge0 deletem ${epair}a";
exec.poststop += "ifconfig ${epair}a destroy";
# Per-jail settings
www {
path = "/jails/www0/12.1-RELEASE/root";
host.hostname = "www";
$epair = "epair0"; # must be unique in every jail
exec.consolelog = "/jails/www0/console.log";
}Output of
jls and ifconfig from the host
Code:
[admin@lockdown ~]$ jls
JID IP Address Hostname Path
2 www /jails/www0/12.1-RELEASE/root
[admin@lockdown ~]$ ifconfig
vtnet0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=2c00b9<RXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWTSO,LINKSTATE,RXCSUM_IPV6>
ether 5e:b6:5e:bd:84:58
inet 10.16.0.101 netmask 0xffffff00 broadcast 10.16.0.255
media: Ethernet 10Gbase-T <full-duplex>
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
inet 127.0.0.1 netmask 0xff000000
groups: lo
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
ether 02:35:3b:a8:4b:00
id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
member: epair0a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 4 priority 128 path cost 2000
member: vtnet0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 1 priority 128 path cost 2000
groups: bridge
nd6 options=1<PERFORMNUD>
epair0a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 02:99:c4:4f:68:0a
inet6 fe80::99:c4ff:fe4f:680a%epair0a prefixlen 64 scopeid 0x4
groups: epair
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
[admin@lockdown ~]$/etc/rc.conf in www jail
Code:
clear_tmp_enable="YES"
sendmail_enable="NONE"
keymap="uk.kbd"
ifconfig_jail0="inet 192.168.60.254 netmask 255.255.255.0ifconfig from the jail
Code:
# ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
inet 127.0.0.1 netmask 0xff000000
groups: lo
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
jail0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 02:99:c4:4f:68:0b
inet 192.168.60.254 netmask 0xffffff00 broadcast 192.168.60.255
groups: epair
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>Pinging the host from the www jail will return a Network is unreachable error. Interestingly, when pining the www jail from the host, the ping is stuck. A traceroute shows the host goes all the way down to my router to find 192.168.60.0/24 and than dies
Code:
[admin@lockdown ~]$ traceroute 192.168.60.254
traceroute to 192.168.60.254 (192.168.60.254), 64 hops max, 40 byte packets
1 10.16.0.1 (10.16.0.1) 0.569 ms 1.208 ms 0.641 ms
2 OpenWrt.lan (172.12.0.1) 1.655 ms 1.596 ms 0.950 ms
3 * * *
4 * * *
[admin@lockdown ~]$Even adding a static route inside the www jail won't help resolving the host. Where am I doing wrong? I am really not good at networking.
Thanks
Last edited:
. Btw, if I want jail0 to be on a different subnet that the host is, do I have to ditch bridge and do routing between epair0a and epair0b as if these were two normal interfaces?
.
.