Re: Jail on 2 interfaces?
Matthew Seaman
> Hi,
>
> I don't see this documented in jail(8) nor rc(8) nor defaults/rc.conf, so is
> it possible to have 2 IP's on 2 ethernet interfaces? And if so, is it settable
> for rc(8)?
>
> The usage case is to have the same jailed proxy server on two seperate
> internal networks. Ideally, the proxy will use one address for outgoing, so I
> guess I'll need a default route or dive into the squid config.
>
> At present I have:
> ifconfig_bge0="inet 192.168.177.60 netmask 255.255.255.0"
> ifconfig_em0="inet 192.168.176.60 netmask 255.255.255.0"
> ifconfig_em0_alias0="inet 192.168.176.62 netmask 255.255.255.255"
> jail_squid_rootdir="/usr/squid"
> jail_squid_ip="192.168.177.62"
> jail_squid_ip_multi0="192.168.176.62"
> jail_squid_interface="bge0"
>
> But this created the IP on bge0 even though one exists on em0. Is it as simple
> as not specifying the interface and add the 177.62 alias on bge0?
> Ideally I'd have a jail_$jail_ip_multi$aliasno_interface="foo0", but my main
> worry is that the jail infrastructure understands the routing involved.
To do this directly is now possible in 8.0-RELEASE or better. You will
need a custom kernel with 'options VIMAGE' and I believe the standard jail
startup scripts need a bit of work in order for them to start the jail with
the correct command line arguments to enable the vnet functionality.
Note that vnet is /experimental/. It may eat your homework and blame it on
your dog. It is also known not to work yet with various subsystems which
haven't had the necessary recoding to understand the new kernel structures.
Probably the most significant missing bit is pf(4).
Alternatively, you can achieve much the same effect that you want by using
a simple one-ip jail and writing firewall rules to redirect traffic into it,
and NAT traffic coming out of it.
Cheers,
Matthew
--
Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
Kent, CT11 9PW
Bjoern A. Zeeb
Hi,
first of all this would find more people to help on freebsd-jail as it
has nothing to do with hackers ;-)
> I don't see this documented in jail(8) nor rc(8) nor defaults/rc.conf, so is
> it possible to have 2 IP's on 2 ethernet interfaces? And if so, is it settable
> for rc(8)?
>
> The usage case is to have the same jailed proxy server on two seperate
> internal networks. Ideally, the proxy will use one address for outgoing, so I
> guess I'll need a default route or dive into the squid config.
>
> At present I have:
> ifconfig_bge0="inet 192.168.177.60 netmask 255.255.255.0"
> ifconfig_em0="inet 192.168.176.60 netmask 255.255.255.0"
> ifconfig_em0_alias0="inet 192.168.176.62 netmask 255.255.255.255"
> jail_squid_rootdir="/usr/squid"
> jail_squid_ip="192.168.177.62"
> jail_squid_ip_multi0="192.168.176.62"
> jail_squid_interface="bge0"
>
> But this created the IP on bge0 even though one exists on em0. Is it as simple
> as not specifying the interface and add the 177.62 alias on bge0?
> Ideally I'd have a jail_$jail_ip_multi$aliasno_interface="foo0", but my main
> worry is that the jail infrastructure understands the routing involved.
>From what you are writing I assume that you are on FreeBSD 7.2-Release
or later; no official FreeBSD version before had supported
multiple-IPs with a jail.
What it did was what you were asking for. That's the problem.
1) either use ifconfig
2) or use jail + interfaces
3) but do not mix them (especially not overlapping)
So I would suggest to do it like this:
# Base system IPs.
ifconfig_bge0="inet 192.168.177.60/24"
ifconfig_em0="inet 192.168.176.60/24"
jail_squid_rootdir="/usr/squid"
# Either use:
jail_squid_ip="bge0|192.168.177.62/32,em0|192.168.176.62/32"
# or:
jail_squid_ip="bge0|192.168.177.62/32"
jail_squid_ip_multi0="em0|192.168.176.62/32"
but do not use jail_squid_interface=".." as that will be a global
default for that jail.
As you can see, I removed the ifconfig_em0_alias0 line. If you want
to keep that and mix things then you could do:
jail_squid_ip="bge0|192.168.177.62/32"
jail_squid_ip_multi0="192.168.176.62/32"
again without the jail_squid_interface=".." line.
HTH
/bz
--
Bjoern A. Zeeb It will not break if you know what you are doing.
_______________________________________________
freebsd...@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hacke...@freebsd.org"
Bjoern A. Zeeb
No, that's wrong. FreeBSD 7.2-R and later can do multi-IP jails and
have the IPs on multiple interfaces; there is no need for a dedicated
network stack.
The routing is no much different than if you would do it in the base
system with two IPs. if it works there, just putting it in a multi-IP
jail with the adresses on the right interface will just work as well.
If you want different routing for a jail use setfib with a multi-FIB
based kernel (you may need to recompile the kernel for that) but you
still won't need mutliple network stacks.
> Alternatively, you can achieve much the same effect that you want by using
> a simple one-ip jail and writing firewall rules to redirect traffic into it,
> and NAT traffic coming out of it.
Using firewall NAT with jails is something I often see and usually
never understand unless people only have a single IP and want to share
that between lots of jails (though if not duplicate services exist,
that will just work as well by default these days as well).
Mel Flynn
> On Tue, 22 Dec 2009, Mel Flynn wrote:
>
> Hi,
>
> first of all this would find more people to help on freebsd-jail as it
> has nothing to do with hackers ;-)
Yes, that was pretty braindead of me, especially since the intention was
questions@.
> > I don't see this documented in jail(8) nor rc(8) nor defaults/rc.conf, so
> > is it possible to have 2 IP's on 2 ethernet interfaces? And if so, is it
> > settable for rc(8)?
> >
> > The usage case is to have the same jailed proxy server on two seperate
> > internal networks. Ideally, the proxy will use one address for outgoing,
> > so I guess I'll need a default route or dive into the squid config.
> >
> > At present I have:
> > ifconfig_bge0="inet 192.168.177.60 netmask 255.255.255.0"
> > ifconfig_em0="inet 192.168.176.60 netmask 255.255.255.0"
> > ifconfig_em0_alias0="inet 192.168.176.62 netmask 255.255.255.255"
> > jail_squid_rootdir="/usr/squid"
> > jail_squid_ip="192.168.177.62"
> > jail_squid_ip_multi0="192.168.176.62"
> > jail_squid_interface="bge0"
> >
> > But this created the IP on bge0 even though one exists on em0. Is it as
> > simple as not specifying the interface and add the 177.62 alias on bge0?
> > Ideally I'd have a jail_$jail_ip_multi$aliasno_interface="foo0", but my
> > main worry is that the jail infrastructure understands the routing
> > involved.
> >
> >From what you are writing I assume that you are on FreeBSD 7.2-Release
>
> or later; no official FreeBSD version before had supported
> multiple-IPs with a jail.
8.0-p3, yes.
> What it did was what you were asking for. That's the problem.
>
> 1) either use ifconfig
> 2) or use jail + interfaces
> 3) but do not mix them (especially not overlapping)
>
> So I would suggest to do it like this:
>
> # Base system IPs.
> ifconfig_bge0="inet 192.168.177.60/24"
> ifconfig_em0="inet 192.168.176.60/24"
>
> jail_squid_rootdir="/usr/squid"
> # Either use:
> jail_squid_ip="bge0|192.168.177.62/32,em0|192.168.176.62/32"
> # or:
> jail_squid_ip="bge0|192.168.177.62/32"
> jail_squid_ip_multi0="em0|192.168.176.62/32"
>
> but do not use jail_squid_interface=".." as that will be a global
> default for that jail.
Is it a global *default* or a global? For example, could I specify:
jail_squid_interface="bge0"
jail_squid_ip="192.168.177.62/32"
jail_squid_ip_multi0="192.168.177.63/32"
jail_squid_ip_multi1="em0|192.168.177.62/32"
Below is a patch against HEAD to document the $interface|$ip syntax.
--
Mel
Index: etc/defaults/rc.conf
===================================================================
--- etc/defaults/rc.conf (revision 200901)
+++ etc/defaults/rc.conf (working copy)
@@ -648,6 +648,7 @@
#jail_example_fib="0" # Routing table for setfib(1)
#jail_example_ip="192.0.2.10,2001:db8::17" # Jail's primary IPv4 and IPv6 address
#jail_example_ip_multi0="2001:db8::10" # and another IPv6 address
+#jail_example_ip_multi1="em0|192.0.3.10/32" # and another IPv4 address on a specific interface
#jail_example_exec_start="/bin/sh /etc/rc" # command to execute in jail for starting
#jail_example_exec_afterstart0="/bin/sh command" # command to execute after the one for
# starting the jail. More than one can be
Bjoern A. Zeeb
>> or later; no official FreeBSD version before had supported
>> multiple-IPs with a jail.
>
> 8.0-p3, yes.
ok
>> What it did was what you were asking for. That's the problem.
>>
>> 1) either use ifconfig
>> 2) or use jail + interfaces
>> 3) but do not mix them (especially not overlapping)
>>
>> So I would suggest to do it like this:
>>
>> # Base system IPs.
>> ifconfig_bge0="inet 192.168.177.60/24"
>> ifconfig_em0="inet 192.168.176.60/24"
>>
>> jail_squid_rootdir="/usr/squid"
>> # Either use:
>> jail_squid_ip="bge0|192.168.177.62/32,em0|192.168.176.62/32"
>> # or:
>> jail_squid_ip="bge0|192.168.177.62/32"
>> jail_squid_ip_multi0="em0|192.168.176.62/32"
>>
>> but do not use jail_squid_interface=".." as that will be a global
>> default for that jail.
>
> Is it a global *default* or a global? For example, could I specify:
It's a global default; a more specific interface name that comes with
an address will override it. So you could do what you drafted below.
The entire "ifconfig" feature in rc.d/jail does not really belong
there but people started using it after it was introduced so we lost
that race.
> jail_squid_interface="bge0"
> jail_squid_ip="192.168.177.62/32"
> jail_squid_ip_multi0="192.168.177.63/32"
> jail_squid_ip_multi1="em0|192.168.177.62/32"
>
> Below is a patch against HEAD to document the $interface|$ip syntax.
That wasn't done on purpose; man rc.conf has it, if you lookup jail_<jname>_ip .
/bz
--
Bjoern A. Zeeb It will not break if you know what you are doing.