From owner-freebsd-current@FreeBSD.ORG Tue May 31 10:41:12 2005 Return-Path: X-Original-To: freebsd-current@freebsd.org Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D5DDC16A41C for ; Tue, 31 May 2005 10:41:12 +0000 (GMT) (envelope-from tataz@tataz.chchile.org) Received: from postfix4-1.free.fr (postfix4-1.free.fr [213.228.0.62]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6281143D4C for ; Tue, 31 May 2005 10:41:12 +0000 (GMT) (envelope-from tataz@tataz.chchile.org) Received: from tatooine.tataz.chchile.org (vol75-8-82-233-239-98.fbx.proxad.net [82.233.239.98]) by postfix4-1.free.fr (Postfix) with ESMTP id 0A742317CA9; Tue, 31 May 2005 12:41:11 +0200 (CEST) Received: by tatooine.tataz.chchile.org (Postfix, from userid 1000) id E6AB7407E; Tue, 31 May 2005 12:41:04 +0200 (CEST) Date: Tue, 31 May 2005 12:41:04 +0200 From: Jeremie Le Hen To: Emanuel Strobl Message-ID: <20050531104104.GL54337@obiwan.tataz.chchile.org> References: <200505310014.50780@harrymail> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200505310014.50780@harrymail> User-Agent: Mutt/1.5.9i Cc: freebsd-current@freebsd.org Subject: Re: different default gateway for jails planed/possible? X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 May 2005 10:41:13 -0000 Hi Emanuel, > will it be possible to define a different default gateway for a jail? > Imagine a system with two interfaces, one for the host on a local GbE > Switch (with NFS service) and the other one connected to a different > DMZ-Switch which should serve different jails. > Now the DMZ is useless since anybody who broke into one jail can reach all > hosts on the "host" interface without having the possibillity to restrict > traffic on the router since the packets go straight to the GbE interface. > This is a big security disadvantage and if I block these packets I can't > any longer connect from machines inside the GbE network to the jails in > the DMZ. The request will be routed but answers go down the "host" > interface, instead to the DMZ router interface. Even a different default > gateway wouldn't help in this case, the kernel had to "keep in mind" that > packets from a jail mustn't be forwarded through any jail-foreign > interface. Also the usual routing table had to be overwritten since > packets from a jail should go over the router to the GbE network (although > there is a well known route, the interface which has the GbE net > configured). > But at least packets from a jail should be limited that they can't pass any > other interface(s) than the one(s) which belong to the particular jail. > I think PFs route-to next-hop rule would be a workarround for my problem > but I'm not too happy to have PF on a GbE Fileserver. I think you can use ipfw(8) as a workaround, since it knows about jail IDs and can forward packets any IP address. Netgraph is maybe an alternative, but I'm not sure about it. IMHO, hacking the IP stack in order to make it jail aware would lead to a real mess. The right way to do this would be to have IP stack virtualization, as it exists for RELENG_4 [1]. Unfortunately, this is available neither for RELENG_5 nor CURRENT, and my coding skills are clearly not good enough to do this. > Another jail question: Is it possible to limit resources on jail-basis? > Like resource restrictions for useres in login.conf only for whole jails. AFAIK, no, this is not possible, this would need virtualization as well. [1] http://www.tel.fer.hr/zec/vimage/ Regards, -- Jeremie Le Hen < jeremie at le-hen dot org >< ttz at chchile dot org >