From owner-freebsd-stable@FreeBSD.ORG Wed Jan 31 11:21:43 2007 Return-Path: X-Original-To: freebsd-stable@freebsd.org Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 78B9516A401 for ; Wed, 31 Jan 2007 11:21:43 +0000 (UTC) (envelope-from freebsd-stable@dino.sk) Received: from bsd.dino.sk (bsd.dino.sk [213.215.72.60]) by mx1.freebsd.org (Postfix) with ESMTP id 11E4813C474 for ; Wed, 31 Jan 2007 11:21:42 +0000 (UTC) (envelope-from freebsd-stable@dino.sk) Received: from [192.168.16.241] (home.dino.sk [84.245.95.252]) (AUTH: PLAIN milan, TLS: TLSv1/SSLv3,256bits,AES256-SHA) by bsd.dino.sk with esmtp; Wed, 31 Jan 2007 12:26:14 +0100 id 00000074.45C07CD7.0000F851 From: Milan Obuch To: freebsd-stable@freebsd.org Date: Wed, 31 Jan 2007 12:21:33 +0100 User-Agent: KMail/1.9.5 References: <45C06A42.6000001@sailorfej.net> <200701311119.47888.freebsd-stable@dino.sk> <45C0722B.3060504@sailorfej.net> In-Reply-To: <45C0722B.3060504@sailorfej.net> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200701311221.34003.freebsd-stable@dino.sk> Subject: Re: jails and multple interfaces X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jan 2007 11:21:43 -0000 On Wednesday 31 January 2007 11:40, Jeffrey Williams wrote: > Milan Obuch wrote: > > On Wednesday 31 January 2007 11:06, Jeffrey Williams wrote: > >> Hi Folks, > >> > >> I am trying to set a jail hosting server to support multiple jails for > >> development testing. > >> > >> The server has two network interfaces, I am configuring one for host > >> server to use, and the other with several aliased IPs, one for each of > >> the jail servers. > >> > >> All the services running on the host are configured to bind to the host > >> IP on the first interface. > >> ... > > > > Why are you doing this? Are your addresses from the same network segment? > > I am binding my jail addresses to loopback interface and route them - > > this way you could easily start take-over jail on another machine and > > change routing table (or use dynamic routing) to minimize downtime on > > hardware upgrades, big OS upgrades etc. I do not consider this the best > > way, but it just satisfy my needs. > > Regards, > > Milan > > I want to segregate the jail and jail host traffic on separate interfaces. > What do you mean with segregate? Why do you need them going through two physical interfaces? Maybe I just can't see my nose between eyes, but I do not understand the purpose of doing so. > How do you route traffic off you loopback interface? by definition, this > interface only allows the network stack to talk to itself? > There is nothing special there - my physical interface address is from one segment, there is route added on upstream router for loopback bound addresses. It is not true you are able to talk only to itself with loopback address, it is true only for loopback address (127.0.0.1/8). All my tests shows it works the way I want. Actually in jail you see only one IP address on an interfaces, and regardless which one, all traffic from jailed process uses this address as source address. Routing is done in host stack in any case. Regards, Milan -- This address is used only for mailing list response. Do not send any personal messages to it, use milan in address instead.