From owner-freebsd-jail@freebsd.org Mon Oct 16 14:28:33 2017 Return-Path: Delivered-To: freebsd-jail@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 5E077E3BDED for ; Mon, 16 Oct 2017 14:28:33 +0000 (UTC) (envelope-from marko.cupac@mimar.rs) Received: from mail.mimar.rs (tazar.mimar.rs [193.53.106.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 114F282A23 for ; Mon, 16 Oct 2017 14:28:32 +0000 (UTC) (envelope-from marko.cupac@mimar.rs) Received: from tazar.mimar.rs (localhost [127.0.2.132]) by mail.mimar.rs (Postfix) with ESMTP id 85A4A620C08B; Mon, 16 Oct 2017 16:18:52 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mimar.rs; h= content-transfer-encoding:content-type:content-type:mime-version :x-mailer:organization:references:in-reply-to:message-id:subject :subject:from:from:date:date:received:received; s=mimar-0901; t= 1508163525; x=1509977926; bh=cnNLWnMVQbVsE0Tp1BkUL4ao50mIQp5O3pF PkgOXBYo=; b=KVvlXNvfMZidYR2LAidwxGx0HrjD8jXBYhA4QsU6TwuYhKcPQya BFvyd1KZWrHLIXOZIz3Ct946j8oVBxzqY1UQt63TBgh2FE9qSoYgCoPj43DT1cTy waMi/175sklEITjbqRt7omzIADV4XUo0odCTHvh+1dyAsrKhyH5UT2QU= X-Virus-Scanned: amavisd-new at mimar.rs Received: from mail.mimar.rs ([127.0.2.132]) by tazar.mimar.rs (amavis.mimar.rs [127.0.2.132]) (amavisd-new, port 10026) with LMTP id SlCtVZlX3tRe; Mon, 16 Oct 2017 16:18:45 +0200 (CEST) Received: from efreet-freebsd.kappastar.com (nat-nat.kappastar.com [193.53.106.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: marko.cupac) by mail.mimar.rs (Postfix) with ESMTPSA id 5DD23620BD58; Mon, 16 Oct 2017 16:18:45 +0200 (CEST) Date: Mon, 16 Oct 2017 16:18:44 +0200 From: Marko =?UTF-8?B?Q3VwYcSH?= To: Andrew Hotlab Cc: "freebsd-jail@freebsd.org" Subject: Re: setfib (ez)jails and wierd routing Message-ID: <20171016161844.7ddb1fe7@efreet-freebsd.kappastar.com> In-Reply-To: References: <20170929103258.2f912308@efreet-freebsd.kappastar.com> Organization: Mimar X-Mailer: Claws Mail 3.15.1 (GTK+ 2.24.31; amd64-portbld-freebsd11.1) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-BeenThere: freebsd-jail@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Discussion about FreeBSD jail\(8\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Oct 2017 14:28:33 -0000 On Sat, 30 Sep 2017 10:38:58 +0000 Andrew Hotlab wrote: > Hi Marko. I'm running an almost identical setup, but I do not have > this issue: ICMP echo reply packets are sent from the right > interface. The only difference is that I didn't defined additional > lo1 and lo2 interfaces, but I guess it shouldn't be the cause. >=20 > I'm running releng/10.3. Which release are you working on? Hi Andrew, sorry for late reply. I'm running 11.1-RELEASE-p1. I am definitely seeing packets with source addresses of my DMZ jails (fib2) exiting through interface on local LAN. Those are mostly icmp echo replies that should be coming from jails but are not due to the fact that jails don't have raw sockets enables. So, echo replies are returned from host (and not jails), whose default gateway is on internal network. Would freebsd-net be more appropriate list for this problem? Thank you in advance, --=20 Before enlightenment - chop wood, draw water. After enlightenment - chop wood, draw water. Marko Cupa=C4=87 https://www.mimar.rs/