From owner-freebsd-questions@freebsd.org Thu May 31 08:55:22 2018 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id D3AF5EF3516 for ; Thu, 31 May 2018 08:55:21 +0000 (UTC) (envelope-from herbert@gojira.at) Received: from mail.bsd4all.net (mail.bsd4all.net [144.76.30.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.bsd4all.net", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 7824E79044 for ; Thu, 31 May 2018 08:55:21 +0000 (UTC) (envelope-from herbert@gojira.at) Date: Thu, 31 May 2018 10:55:19 +0200 Message-ID: <87vab4mcg8.wl-herbert@gojira.at> From: "Herbert J. Skuhra" To: freebsd-questions@freebsd.org Subject: Re: What have I neglected to do in order to get networking in a jail? In-Reply-To: <3d2630ccefe11fb3fa94678665b4f7c6.squirrel@webmail.harte-lyne.ca> References: <3d2630ccefe11fb3fa94678665b4f7c6.squirrel@webmail.harte-lyne.ca> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM/1.14.9 (=?ISO-8859-4?Q?Goj=F2?=) APEL/10.8 EasyPG/1.0.0 Emacs/27.0 (x86_64-pc-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 May 2018 08:55:22 -0000 On Wed, 30 May 2018 17:24:03 +0200, "James B. Byrne via freebsd-questions" wrote: > > On FreeBSD-11.1 host: > > [root@host:~]# service pf onestatus > pf.ko is not loaded > > > In /etc/rc.conf > . . . > defaultrouter="216.185.71.1" # Gateway > gateway_enable="YES" # Enable as ipv4 LAN gateway for > guests/jails > #ipv6_gateway_enable="YES" # Enable as ipv6 LAN gateway > > # Aliases on the host i/f are set here - jailed aliases are handled by > ezjail > ifconfig_vtnet0_alias0="inet 192.168.216.18 netmask 255.255.255.255" > #ifconfig_vtnet0_alias1="inet 192.168.216.xxx netmask 0xFFFFFFFF" > #ifconfig_vtnet0_alias2="inet 192.168.216.xxy netmask 0xFFFFFFFF" > > ### Enable and configure ezjail jails > # Setup the loopback interfaces that each jail will use > # Remember to add a 'set skip on lo#' clause in /etc/pf.conf > cloned_interfaces="lo1 lo2" > ipv4_addrs_lo1="127.0.31.1/32" > ipv4_addrs_lo2="127.0.32.1/32" > > ### Jailed Services > ezjail_enable="YES" # Enable ezjail jail manager > > > [root@host:~]# ifconfig > > vtnet0: flags=8943 > metric 0 mtu 1500 > options=80028 > ether 58:9c:fc:0e:cd:bb > hwaddr 58:9c:fc:0e:cd:bb > inet 216.185.71.18 netmask 0xffffff00 broadcast 216.185.71.255 > inet 192.168.216.18 netmask 0xffffffff broadcast 192.168.216.18 > inet 218.185.71.31 netmask 0xffffffff broadcast 218.185.71.31 > inet 192.168.216.31 netmask 0xffffffff broadcast 192.168.216.31 > nd6 options=29 > media: Ethernet 10Gbase-T > status: active > lo0: flags=8049 metric 0 mtu 16384 > options=600003 > inet6 ::1 prefixlen 128 > inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2 > inet 127.0.0.1 netmask 0xff000000 > nd6 options=21 > groups: lo > lo1: flags=8049 metric 0 mtu 16384 > options=600003 > inet 127.0.31.1 netmask 0xffffffff > nd6 options=29 > groups: lo > lo2: flags=8049 metric 0 mtu 16384 > options=600003 > inet 127.0.32.1 netmask 0xffffffff > nd6 options=29 > groups: lo > > > [root@host:~]# jls > JID IP Address Hostname Path > 1 127.0.31.1 mx31 /usr/jails/mx31 > > > On jail: > > root@mx31:~ # sysctl security.jail.allow_raw_sockets > security.jail.allow_raw_sockets: 1 > > root@mx31:~ # ifconfig > vtnet0: flags=8943 > metric 0 mtu 1500 > options=80028 > ether 58:9c:fc:0e:cd:bb > hwaddr 58:9c:fc:0e:cd:bb > inet 218.185.71.31 netmask 0xffffffff broadcast 218.185.71.31 > inet 192.168.216.31 netmask 0xffffffff broadcast 192.168.216.31 > media: Ethernet 10Gbase-T > status: active > lo0: flags=8049 metric 0 mtu 16384 > options=600003 > groups: lo > lo1: flags=8049 metric 0 mtu 16384 > options=600003 > inet 127.0.31.1 netmask 0xffffffff > groups: lo > lo2: flags=8049 metric 0 mtu 16384 > options=600003 > groups: lo > > root@mx31:~ # cat /etc/resolv.conf > search harte-lyne.ca > nameserver 216.185.71.33 > nameserver 216.185.71.34 > nameserver 127.0.0.1 > options edns0 > > root@mx31:~ # cat /etc/hosts > # $FreeBSD: releng/11.1/etc/hosts 109997 2003-01-28 21:29:23Z dbaker $ > # > # Host Database > . . . > # > # > ::1 localhost localhost.harte-lyne.ca > 127.0.0.1 localhost localhost.harte-lyne.ca > > > root@mx31:~ # pkg install bash > The package management tool is not yet installed on your system. > Do you want to fetch and install it now? [y/N]: y > Bootstrapping pkg from > pkg+http://pkg.FreeBSD.org/FreeBSD:11:amd64/quarterly, please wait... > pkg: Error fetching > http://pkg.FreeBSD.org/FreeBSD:11:amd64/quarterly/Latest/pkg.txz: No > address record > A pre-built version of pkg could not be found for your system. > Consider changing PACKAGESITE or installing it from ports: > 'ports-mgmt/pkg'. > > > > root@mx31:~ # ping 216.185.71.1 > PING 216.185.71.1 (216.185.71.1): 56 data bytes > ^C > --- 216.185.71.1 ping statistics --- > 5 packets transmitted, 0 packets received, 100.0% packet loss > > Why does this jail not have a network connection? After a quick check I guess you are missing NAT on the host (pf or ipfw)? -- Herbert