Web Server in a Jail (ezjail) on VPS

T

thomas_d

Hi All,

I'd just like to confirm the correct approach to what I'm trying to achieve, here's what I've got:

  • VPS running FreeBSD 10, fresh install
  • A single NIC (re0), but with two public IP addresses, let's say 88.88.88.88 and 99.99.99.99 for purpose of thread, the provider has advised that both are /24 and their default route can go to the .1 of their respective network, though I've been able to work with both IP addresses just using a single default route e.g. 88.88.88.1, no need for 99.99.99.1
What I'm going for is an internet-facing web server in a jail let's say on the 99.99.99.99 IP address (the host is using the 88.88.88.88 address for network connectivity and any other services currently).

I've installed installed ezjail, ran ezjail-admin install, put ezjail_enable="YES" into /etc/rc.conf, created additional loopback lo1, started jails and then created jail with ezjail-admin create webserver 'lo1|99.99.99.99', console into the jail, configure /etc/resolv.conf in the jail to point to public DNS severs, try to use pkg to install something e.g. apache24, it goes to fetch pkg and then just hangs at that 'Bootstrapping pkg' prompt.

Some advice on what's going on vs. what should be going on here would be much appreciated, apologies for cluelessness
 
What's happening is the request leaves the FreeBSD machine but your gateway cannot find 99.99.99.99 when it sends the reply back. This is because of a layer 2 communication issue. The 99.99.99.1 gateway will do an ARP request for 99.99.99.99 but the server will not reply back because that address is on the loopback. The solution would be either to NAT to the "external" interface when you are using jails on the loopback or to simply create the jail on the external interface using: ezjail-admin create webserver 're0|99.99.99.99'
 
Thank you! Got network connectivity in the jail now, did the ext_if|x.x.x.x method.

I notice my host now has both IP addresses against the one interface now, will the host now continue to use only its primary IP address for its own communications, or could this be a problem?
 
The IP address aliases will only get used when you explicitly ask to use them. In the case of a jail bound to it, the jail will always use it. There shouldn't be any issues.
 
You must log in or register to reply here.
Back
Top