From owner-freebsd-jail@FreeBSD.ORG Thu Oct 2 15:21:43 2014 Return-Path: Delivered-To: freebsd-jail@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id B9E74BD4; Thu, 2 Oct 2014 15:21:43 +0000 (UTC) Received: from m2.gritton.org (gritton.org [63.246.134.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 8695812B; Thu, 2 Oct 2014 15:21:43 +0000 (UTC) Received: from [192.168.0.34] (c-50-168-192-61.hsd1.ut.comcast.net [50.168.192.61]) (authenticated bits=0) by m2.gritton.org (8.14.9/8.14.9) with ESMTP id s92FLeJm060358; Thu, 2 Oct 2014 09:21:40 -0600 (MDT) (envelope-from jamie@gritton.org) Message-ID: <542D6D7D.6000507@gritton.org> Date: Thu, 02 Oct 2014 09:21:33 -0600 From: James Gritton User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 MIME-Version: 1.0 To: freebsd-jail@freebsd.org, freebsd-stable@freebsd.org Subject: Re: no network connection from inside a jail References: <20141002180506.4965760b@X220.alogt.com> <542D4A1B.4060405@gritton.org> <20141002222553.42bf17e3@X220.alogt.com> In-Reply-To: <20141002222553.42bf17e3@X220.alogt.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-jail@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "Discussion about FreeBSD jail\(8\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Oct 2014 15:21:43 -0000 On 10/2/2014 8:25 AM, Erich Dollansky wrote: > Hi, > > On Thu, 02 Oct 2014 06:50:35 -0600 > James Gritton wrote: > >> On 10/2/2014 4:05 AM, Erich Dollansky wrote: >>> Hi, >>> >>> I recently upgraded to 10.1 BETA3 via sources. All seemed to be fine >>> until I started jails which connect to the Internet. It simply does >>> not work anymore. When the browser from the jail connects to >>> another jail on the same machine via HTTP, it all works. Accesses >>> to the ouside of the machine fails. >>> >>> Even a ping to a local device does not work. >>> >>> ping 192.168.yyy.xxx >>> ping: socket: Operation not permitted >>> >>> despite having >>> >>> security.jail.allow_raw_sockets: 1 >>> >>> Just to make sure, I upgraded also the world in all jails without >>> any difference. >>> >>> UPDATING did not mention any changes since BETA1. >>> >>> I feel a bit lost now. >>> >>> What could have caused the problems? >>> >>> Erich >> It would be handle to see what happens when the IP addresses are set >> on the jail in the first place. Try running: >> >> jail -r '*' >> jail -v -c '*' >> >> and look at the results when it (presumably) runs ifconfig. >> Hopefully, there'll be a clue there. > this looks pretty normal to me: > > ClawsMailTest: run command: /sbin/ifconfig lagg0 inet 192.168.0.17 > netmask 255.255.255.255 -alias > MemDisk: run command: /sbin/ifconfig > lagg0 inet 192.168.0.16 netmask 255.255.255.255 alias > Projekte: run command: /sbin/ifconfig lagg0 inet 192.168.0.11 netmask > 255.255.255.255 alias > Ports: run command: /sbin/ifconfig lagg0 inet 192.168.0.12 netmask > 255.255.255.255 alias > TestInternet: run command: /sbin/ifconfig lagg0 > inet 192.168.0.19 netmask 255.255.255.255 alias TestInternet: run > command: /sbin/mount -t devfs > -oruleset=4 . /usr/home/jails/TestInternet/dev > > This is just an extract. > > I am now able to use ping. It only allows me to ping other jails on the > same machine. Even a ping to any device at the LAN does not work. > > I get now this: > > ln: /dev/log: Operation not permitted > > which I did not notice before the upgrade. > > What I did not mention before. I am able to connect to the jails via > telnet from the machine's rooot but not from any other machine. > > Of course, the setup worked before without any problems. Yes, that looks normal to me too. Also, don't worry about the /dev/log message - it's been there for quite a while. - Jamie