From owner-freebsd-questions@freebsd.org Tue Oct 6 10:16:07 2015 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 9DCE49B6287 for ; Tue, 6 Oct 2015 10:16:07 +0000 (UTC) (envelope-from trond@fagskolen.gjovik.no) Received: from smtp.fagskolen.gjovik.no (smtp.fagskolen.gjovik.no [IPv6:2001:700:1100:1:200:ff:fe00:b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "smtp.fagskolen.gjovik.no", Issuer "Fagskolen i Gj??vik" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 2E320824 for ; Tue, 6 Oct 2015 10:16:06 +0000 (UTC) (envelope-from trond@fagskolen.gjovik.no) Received: from mail.fig.ol.no (localhost [127.0.0.1]) by mail.fig.ol.no (8.15.2/8.15.2) with ESMTPS id t96AFwK1099695 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 6 Oct 2015 12:15:58 +0200 (CEST) (envelope-from trond@fagskolen.gjovik.no) Received: from localhost (trond@localhost) by mail.fig.ol.no (8.15.2/8.15.2/Submit) with ESMTP id t96AFwBq099692; Tue, 6 Oct 2015 12:15:58 +0200 (CEST) (envelope-from trond@fagskolen.gjovik.no) X-Authentication-Warning: mail.fig.ol.no: trond owned process doing -bs Date: Tue, 6 Oct 2015 12:15:58 +0200 (CEST) From: =?ISO-8859-1?Q?Trond_Endrest=F8l?= Sender: Trond.Endrestol@fagskolen.gjovik.no To: Niklaas Baudet von Gersdorff cc: FreeBSD questions Subject: Re: IPv6 only Jails cannot connect to the outside world In-Reply-To: <56139A43.9010904@kulturflatrate.net> Message-ID: References: <5611AFCA.4010909@kulturflatrate.net> <5611CA44.4030602@radel.com> <56123260.1010901@kulturflatrate.net> <56127D73.5040001@hiwaay.net> <5612E192.6040404@kulturflatrate.net> <56139A43.9010904@kulturflatrate.net> User-Agent: Alpine 2.20 (BSF 67 2015-01-07) Organization: Fagskolen Innlandet OpenPGP: url=http://fig.ol.no/~trond/trond.key MIME-Version: 1.0 X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED, AWL autolearn=ham autolearn_force=no version=3.4.1 X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on mail.fig.ol.no Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8BIT X-Content-Filtered-By: Mailman/MimeDel 2.1.20 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Oct 2015 10:16:07 -0000 On Tue, 6 Oct 2015 11:54+0200, Niklaas Baudet von Gersdorff wrote: > On 06/10/15 11:42, Trond Endrestøl wrote: > > You could run local_unbound in each jail, point /etc/resolv.conf to > > 127.0.0.1 or ::1, and have unbound forward each query to as many > > resolvers as you like. Or use dns/bind910 if you prefer that one. > > Thank you for pointing that out. I am not very much into DNS resolving > yet; but I already put your advice on my "further reading" list. > > Would you recommend either of them? local_unbound is in base, if you prefer to limit the number of installed ports in each jail. Just add local_unbound_enable="YES" to each jail's /etc/rc.conf. Start the local_unbound service, and let it create its files in /var/unbound. Stop the unbound service. Edit /var/unbound/forward.conf to your heart's content. Add as many "forward-addr:" statements as you need below "name: .". See unbound.conf(5) for more information. You might want to verify the settings in /etc/resolv.conf and /etc/resolvconf.conf. Start the unbound service, and check the resolver using host, ping{,6}, traceroute{,6} ... Once you get one jail running as desired, just copy the configuration files, save /etc/rc.conf, to the other jails. -- +-------------------------------+------------------------------------+ | Vennlig hilsen, | Best regards, | | Trond Endrestøl, | Trond Endrestøl, | | IT-ansvarlig, | System administrator, | | Fagskolen Innlandet, | Gjøvik Technical College, Norway, | | tlf. mob. 952 62 567, | Cellular...: +47 952 62 567, | | sentralbord 61 14 54 00. | Switchboard: +47 61 14 54 00. | +-------------------------------+------------------------------------+ From owner-freebsd-questions@freebsd.org Tue Oct 6 10:36:23 2015 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id BBF909D0399 for ; Tue, 6 Oct 2015 10:36:23 +0000 (UTC) (envelope-from niklaas@kulturflatrate.net) Received: from mail2.kulturflatrate.net (mail.financecomm.com [178.63.105.5]) by mx1.freebsd.org (Postfix) with ESMTP id 7C42418A for ; Tue, 6 Oct 2015 10:36:22 +0000 (UTC) (envelope-from niklaas@kulturflatrate.net) Received: from [10.0.0.38] (mail.kulturflatrate.net [IPv6:2a01:488:66:1000:2ea3:77dd:0:1]) (Authenticated sender: niklaas@kulturflatrate.net) by mail2.kulturflatrate.net (Postfix) with ESMTPSA id 1C9652DC98; Tue, 6 Oct 2015 12:36:18 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=kulturflatrate.net; s=default; t=1444127778; bh=ivSCDgiUWisQ5dLwl2HpYgnLa8/BQC1aijQRaLIQJM0=; h=Subject:To:References:Cc:From:Date:In-Reply-To; b=kNSrOrXRwP5tzDgeQwOw4lWkSd4M84BAtmtztQJ10yTYfekbkRwqOZoRTVmi28vnN rL8JOC52np7Jx7rrqR1cNK984z7oDG3wgPJW6MdPK/puqjwSv7nqndshRoMn30j3qP Kg5pg3V0E7zQeQVqCJ7oDc38AijBFuA292z+2Frw= Subject: Re: IPv6 only Jails cannot connect to the outside world To: =?UTF-8?Q?Trond_Endrest=c3=b8l?= References: <5611AFCA.4010909@kulturflatrate.net> <5611CA44.4030602@radel.com> <56123260.1010901@kulturflatrate.net> <56127D73.5040001@hiwaay.net> <5612E192.6040404@kulturflatrate.net> <56139A43.9010904@kulturflatrate.net> Cc: FreeBSD questions From: Niklaas Baudet von Gersdorff Message-ID: <5613A4AC.5020002@kulturflatrate.net> Date: Tue, 6 Oct 2015 12:38:36 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Oct 2015 10:36:23 -0000 On 06/10/15 12:15, Trond Endrestøl wrote: > local_unbound is in base, if you prefer to limit the number of > installed ports in each jail. OK. That's a good reason. > Just add local_unbound_enable="YES" to each jail's /etc/rc.conf. > > Start the local_unbound service, and let it create its files in > /var/unbound. Stop the unbound service. > > Edit /var/unbound/forward.conf to your heart's content. Add as many > "forward-addr:" statements as you need below "name: .". See > unbound.conf(5) for more information. > > You might want to verify the settings in /etc/resolv.conf and > /etc/resolvconf.conf. > > Start the unbound service, and check the resolver using host, > ping{,6}, traceroute{,6} ... > > Once you get one jail running as desired, just copy the configuration > files, save /etc/rc.conf, to the other jails. Thanks a lot! I very appreciate your help. This looks quite straightforward and like a perfect solution for my setup. -- Niklaas