From owner-freebsd-net@FreeBSD.ORG Sun Dec 29 00:16:15 2013 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 2E0DBC01 for ; Sun, 29 Dec 2013 00:16:15 +0000 (UTC) Received: from mail-la0-x22c.google.com (mail-la0-x22c.google.com [IPv6:2a00:1450:4010:c03::22c]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id A830B1640 for ; Sun, 29 Dec 2013 00:16:14 +0000 (UTC) Received: by mail-la0-f44.google.com with SMTP id ep20so4995484lab.31 for ; Sat, 28 Dec 2013 16:16:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=vsDIDwaL2ctYdY/7jZLWnn5DitB4kXEvILobShCX4SU=; b=GqRR/0LXRdW8bo0/xWasUYtvWH7UKrFYVEu8RhKameN/7iryWZKNCDoYPyuWVWLzR9 rEx2bTqsE4kkVmkBcPvD6B628Kf3RFWiKDWpSXXSLVYl0KGWFtt7cay8wtr0rCx/rxRB 4gbOkWBfjYp/68qzWHIOcNMmW2XgMS2Uxq2hA4Pi7+Ccl7gGyS1mTX7h9CqNXnSK8CE3 w/BgLMj+D0zGlSx/cG67Qs06wXpUbRErsUa8/gAahIvm4nEU/aHvKoof15aCevudcB4V 79bpoUvIEWiv15Dx9eaf05+uXa+JDNV4RRddUIPTdtztoKO4PTO5RQJ/mRC44RiCGXoZ zlpQ== MIME-Version: 1.0 X-Received: by 10.112.135.102 with SMTP id pr6mr8375081lbb.43.1388276172569; Sat, 28 Dec 2013 16:16:12 -0800 (PST) Sender: ndenev@gmail.com Received: by 10.114.242.33 with HTTP; Sat, 28 Dec 2013 16:16:12 -0800 (PST) In-Reply-To: References: Date: Sun, 29 Dec 2013 00:16:12 +0000 X-Google-Sender-Auth: Hmik8uDD_-krY4JMcXfvrrnJ-D8 Message-ID: Subject: Re: Issues putting jails on their own subnet From: Nikolay Denev To: Andrew Klaus Content-Type: text/plain; charset=ISO-8859-1 X-Content-Filtered-By: Mailman/MimeDel 2.1.17 Cc: "freebsd-net@freebsd.org" X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 29 Dec 2013 00:16:15 -0000 Hi Andrew, Actually you should be able to override this routing entry by just deleting it, or you can also check if "net.add_addr_allfibs" sysctl can help you. --Nikolay On Sat, Dec 28, 2013 at 10:05 PM, Andrew Klaus wrote: > Hello, > > I'm trying to segregate some of my jails onto their own (DMZ) subnet. > > Internal subnet: 10.0.3.0/24 > DMZ subnet: 10.0.4.0/24 > > Both of these subnets are on my FreeBSD host, but I'm using a second > routing table for my DMZ jails as seen here: > > --------------- > setfib 1 netstat -rn > Routing tables > > Internet: > Destination Gateway Flags Refs Use Netif Expire > default 10.0.4.1 UGS 0 2393945 vlan4 > 10.0.3.0/24 link#12 U 0 0 vlan3 > ---------------- > > The problem I'm facing, is when I try to connect to the DMZ'd jail from the > 10.0.3.0 network, traffic comes in on vlan4 like it's supposed to, but > replies back through on the vlan3 interface. I guess this makes sense, > because of that second route entry (that I can't override). > > I've tried using PF to force the packets back through to 10.0.4.1, but it > doesn't seem to want to work. Is the only other way to use the > experimental vnet/vimage? > > Any ideas would be helpful. > > Thanks, > > Andrew > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" >