Date: Sun, 19 Jul 2020 15:50:59 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 248109] ipfilter ipf.rules & ipnat.rules not loading when vnet jail starts Message-ID: <bug-248109-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D248109 Bug ID: 248109 Summary: ipfilter ipf.rules & ipnat.rules not loading when vnet jail starts Product: Base System Version: 12.1-RELEASE Hardware: Any OS: Any Status: New Severity: Affects Many People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: joeb1@a1poweruser.com Running 12.1 on real hardware. Vnet jails using bridge/epair method. The rc.conf in the vnet jail is populated with the normal ipfilter lines to start ipfilter at vnet jail start up. ipfilter_enable=3D"YES" ipmon_enable=3D"YES" ipmon_flags=3D"-D" ipfilter_rules=3D"/etc/ipf.rules" ipnat_enable=3D"YES" ipnat_rules=3D"/etc/ipf.nat.rules" The ipf.rules files has this content pass in quick on lo0 all pass out quick on lo0 all block out log quick on epair41b proto tcp from any to any port =3D 43=20 pass in log quick on epair41b all pass out log quick on epair41b all The ipf.nat.rules files has this content map epair41b 0.0.0.0/0 -> 0/32 proxy port 21 ftp/tcp map epair41b 0.0.0.0/0 -> 0/32 I use the native jail command to start and stop the vnet jail. jail -cv jailname jail -rv jailname=20 After logging into the jails console as root. ipfstat -hnoi replies with empty list for ipfilter(out) empty list for ipfilter(in) ipnat -l replies with List of active MAP/Redirects filters: and then a blank line. Then I issue this command from the vnet jails command line to load the rules ipf -FS -Fa -f /etc/ipf.rules followed by ipfstat -hnoi and the filter rules are shown and functioning. You may ask how do I know the rules are functioning? The whois command is blocked by the rule on port 43 and it will not work wh= en I issue it from the vnet console. The same thing is true for ipnat rules when I issue the command to load them ipnat -FC -f /etc/ipf.nat.rules then this command shows results ipnat -l Sure hopping a fix can make it into 12.2 and/or 13.0 For your feedback, I may be the first person to really test ipfilter in sid= e of a vnet jail since ipfilter became vimage aware. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-248109-227>