From owner-freebsd-net@freebsd.org Sun Jun 26 10:06:52 2016 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 55A48A791C9 for ; Sun, 26 Jun 2016 10:06:52 +0000 (UTC) (envelope-from org.freebsd.security@io7m.com) Received: from beige.tulip.relay.mailchannels.net (beige.tulip.relay.mailchannels.net [23.83.218.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 0E0031F8A for ; Sun, 26 Jun 2016 10:06:50 +0000 (UTC) (envelope-from org.freebsd.security@io7m.com) X-Sender-Id: _forwarded-from|212.69.61.187 Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 51890123DFE for ; Sun, 26 Jun 2016 10:06:46 +0000 (UTC) Received: from bs3-dallas.accountservergroup.com (ip-10-37-2-55.us-west-2.compute.internal [10.37.2.55]) by relay.mailchannels.net (Postfix) with ESMTPA id D5777123DC3 for ; Sun, 26 Jun 2016 10:06:45 +0000 (UTC) X-Sender-Id: _forwarded-from|212.69.61.187 Received: from bs3-dallas.accountservergroup.com (bs3-dallas.accountservergroup.com [10.21.150.52]) (using TLSv1 with cipher DHE-RSA-AES256-SHA) by 0.0.0.0:2500 (trex/5.6.15); Sun, 26 Jun 2016 10:06:46 +0000 X-MC-Relay: Forwarding X-MailChannels-SenderId: _forwarded-from|212.69.61.187 X-MailChannels-Auth-Id: wwwh X-MC-Loop-Signature: 1466935606044:3262865481 X-MC-Ingress-Time: 1466935606043 Received: from cust187-dsl61.idnet.net ([212.69.61.187]:54487 helo=copperhead.int.arc7.info) by bs3-dallas.accountservergroup.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.87) (envelope-from ) id 1bH6xg-0003qU-UT for freebsd-net@freebsd.org; Sun, 26 Jun 2016 05:06:45 -0500 Date: Sun, 26 Jun 2016 10:06:43 +0000 From: To: freebsd-net@freebsd.org Subject: Re: Filtering outbound traffic for private address jails? Message-ID: <20160626100643.7a1f650e@copperhead.int.arc7.info> In-Reply-To: References: <20160625220137.1ed8de16@copperhead.int.arc7.info> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-PopBeforeSMTPSenders: com.rockstargames@io7m.com, com.myfitnesspal@io7m.com, com.git-scm@io7m.com, org.codehaus@io7m.com, io.github.lmax-exchange@io7m.com, com.meetup@io7m.com, org.readium@io7m.com, org.khanacademy@io7m.com, com.nexusmods@io7m.com, io.github.apitrace@io7m.com, com.apple@io7m.com, org.apache.commons@io7m.com, org.freebsd.security@io7m.com, com.stronglifts@io7m.com, com.carpediemkravmaga@io7m.com, uk.co.discountsupplements@io7m.com, com.the-blueprints@io7m.com, org.codehaus.mojo@io7m.com, com.skype@io7m.com, com.goodhempnutrition@io7m.com, net.java@io7m.com, com.dropbox@io7m.com, com.io7m.lists@io7m.com, org.openjdk@io7m.com, org.jgrapht@io7m.com, com.google@io7m.com, android-developers@io7m.com, org.opengl@io7m.com, org.mapdb@io7m.com, com.jetbrains@io7m.com, org.eclipse@io7m.com, com.slack@io7m.com, net.openvpn@io7m.com, nu.xom@io7m.com, de.jflex.users@io7m.com, com.blendswap@io7m.com, org.archlinux@io7m.com, com.steampowered@io7m.com, org.mesa3d.mesa-users@io7m.com, org.freesound@io7m.com, org.blender@i o7m.com, com.bugsnag@io7m.com, legalandgeneral@io7m.com, org.freedesktop@io7m.com, org.jogamp@io7m.com, org.junit@io7m.com, org.apache.maven.user@io7m.com, org.sonatype@io7m.com, org.dyn4j@io7m.com, com.creative.opensource.openal@io7m.com, org.fossil-scm.fossil-users@io7m.com, github@io7m.com, code@io7m.com, contact@io7m.com, mark-ext@io7m.com, mark@io7m.com X-AuthUser: X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Jun 2016 10:06:52 -0000 'Lo. On 2016-06-26T02:32:04 +0000 James Lodge wrote: > > If you clone lo1, give it a 192.168.x.x/32 IP and then use the following pf.conf > Do you need to bridge the interfaces? You may need to add gateway_enable="YES" to rc.conf > > Not sure if that's what you're trying to do? > > James > > > IP_PUB="Your Public IP Address Here" > IP_JAIL="192.168.0.2" > NET_JAIL="192.168.0.0/24" > PORT_JAIL="{80,443,2020}" > > scrub in all > nat pass on em0 from $NET_JAIL to any -> $IP_PUB > rdr pass on em0 proto tcp from any to $IP_PUB port $PORT_WWW -> $IP_JAIL Interesting! Writing the filtering rules as "nat pass" statements does at least allow basic outbound filtering, as specifying a rule along with the nat statement allows you to talk about individual specific jails. Thanks, I will try using this if vnet jails don't work out. M