From owner-freebsd-current@freebsd.org  Mon Nov  2 13:59:10 2015
Return-Path: <owner-freebsd-current@freebsd.org>
Delivered-To: freebsd-current@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6AF2FA22D11
 for <freebsd-current@mailman.ysv.freebsd.org>;
 Mon,  2 Nov 2015 13:59:10 +0000 (UTC) (envelope-from kp@FreeBSD.org)
Received: from venus.codepro.be (venus.codepro.be [IPv6:2a01:4f8:162:1127::2])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256
 bits))
 (Client CN "*.codepro.be", Issuer "Gandi Standard SSL CA 2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 343281098
 for <freebsd-current@freebsd.org>; Mon,  2 Nov 2015 13:59:10 +0000 (UTC)
 (envelope-from kp@FreeBSD.org)
Received: from [IPv6:2a02:1811:2419:4e02:f1d5:56e9:24b:faad] (unknown
 [IPv6:2a02:1811:2419:4e02:f1d5:56e9:24b:faad])
 by venus.codepro.be (Postfix) with ESMTPSA id BB5EF1A971;
 Mon,  2 Nov 2015 14:59:06 +0100 (CET)
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3106\))
Subject: Re: pf NAT and VNET Jails
From: Kristof Provost <kp@FreeBSD.org>
In-Reply-To: <6607014.lfu2kQizLV@hbsd-dev-laptop>
Date: Mon, 2 Nov 2015 14:59:03 +0100
Cc: freebsd-current@freebsd.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <D9FD5254-DA54-40B0-B4D6-71F65EB3B84A@FreeBSD.org>
References: <CAExMvs=jVsASLyiqU9nTpir0Hy_s_DfChgf4XKeGWv-8yojNBw@mail.gmail.com>
 <56354BD2.5060608@freebsd.org> <6607014.lfu2kQizLV@hbsd-dev-laptop>
To: Shawn Webb <shawn.webb@hardenedbsd.org>
X-Mailer: Apple Mail (2.3106)
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
 <freebsd-current.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-current>, 
 <mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current/>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
 <mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Nov 2015 13:59:10 -0000


> On 02 Nov 2015, at 14:47, Shawn Webb <shawn.webb@hardenedbsd.org> =
wrote:
>=20
> On Sunday, 01 November 2015 07:16:34 AM Julian Elischer wrote:
>> On 11/1/15 2:50 AM, Shawn Webb wrote:
>>> I'm at r290228 on amd64. I'm not sure which revision I was on last =
when it
>>> last worked, but it seems VNET jails aren't working anymore.
>>>=20
>>> I've got a bridge, bridge1, with an IP of 192.168.7.1. The VNET =
jails set
>>> their default route to 192.168.7.1. The host simply NATs outbound =
from
>>> 192.168.7.0/24 to the rest of the world. The various epairs get =
added to
>>> bridge1 and assigned to each jail. Pretty simple setup. That worked =
until
>>> today. When I do tcpdump on my public-facing NIC, I see that NAT =
isn't
>>> applied. When I run `ping 8.8.8.8` from the jail, the jail's
>>> 192.168.7.0/24
>>> address gets sent on the wire.
>>>=20
>>> Let me know what I can do to help debug this further.
>>=20
>> send the list your setup script/settings?
>=20
> I'm using iocage to start up the jails. Here's a pasted output of =
`iocage get=20
> all mutt-hardenedbsd`: http://ix.io/lLG

Can you add your pf.conf too?

I=E2=80=99ll try upgrading my machine to something beyond 290228 to see =
if I can reproduce it.
It=E2=80=99s on r289635 now, and seems to be fine. My VNET jails =
certainly get their traffic NATed.

Thanks,
Kristof