Date: Mon, 08 Aug 2016 16:10:36 +0000 From: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net> To: "Niklaas Baudet von Gersdorff" <stdin@niklaas.eu> Cc: freebsd-questions@freebsd.org, freebsd-pf@freebsd.org Subject: Re: Firewalling jails and lo0 Message-ID: <474892D3-A01C-43B2-AF07-E383CD81188E@lists.zabbadoz.net> In-Reply-To: <20160808081910.GA27370@box-hlm-03.niklaas.eu> References: <20160806155411.GA5289@len-t420.klaas> <3C1C4822-17C2-42D9-A9BE-C3549B9B6F25@lists.zabbadoz.net> <20160807082651.GA87754@box-hlm-03.niklaas.eu> <57A743A8.10005@gmail.com> <20160807152347.GA9178@len-t420.klaas> <57A76DF6.6090905@gmail.com> <20160808081910.GA27370@box-hlm-03.niklaas.eu>
next in thread | previous in thread | raw e-mail | index | archive | help
On 8 Aug 2016, at 8:19, Niklaas Baudet von Gersdorff wrote:
> Ernie Luzar [2016-08-07 13:20 -0400] :
>
>>> Aha. So once I assigned those traffic from/to jails should go
>>> through lo1 solely?
>>
>> YES.
>
> Thank you for clarifying that and your help. So, I attached
> additional IP addresses on the jail host side accordingly:
…
> My issue can be reduced to the question: When using jails, to
> secure network traffic as best as I can, do I have to enable the
> firewall on lo0 or is enabling it on the interface they are
> attached to (in my case lo1) enough?
>
> And: What do I need to do to restrict jails from using lo0?
The problem I think is that the routes (see one of your earlier emails)
for the jail loopback IP addresses are pointing to lo0 and not lo1.
If you’d manually issue a
route change -host -inet6 fd16:dcc0:f4cc:3::2:1 -iface lo1
Hmm probably not…
root@rabbit4:~ # ifconfig lo1 create
lo1: bpf attached
root@rabbit4:~ # ifconfig lo1 inet6 fd16:dcc0:f4cc:3::2:1/128 alias
root@rabbit4:~ # route get -inet6 fd16:dcc0:f4cc:3::2:1
route to: fd16:dcc0:f4cc:3::2:1
destination: fd16:dcc0:f4cc:3::2:1
fib: 0
interface: lo0
flags: <UP,HOST,DONE,STATIC>
recvpipe sendpipe ssthresh rtt,msec mtu weight expire
0 0 0 0 16384 1 0
root@rabbit4:~ # route change -host -inet6 fd16:dcc0:f4cc:3::2:1 -iface
lo1
change host fd16:dcc0:f4cc:3::2:1: gateway lo1 fib 0
root@rabbit4:~ # route get -inet6 fd16:dcc0:f4cc:3::2:1
route to: fd16:dcc0:f4cc:3::2:1
destination: fd16:dcc0:f4cc:3::2:1
fib: 0
interface: lo0
flags: <UP,HOST,DONE,STATIC>
recvpipe sendpipe ssthresh rtt,msec mtu weight expire
0 0 0 0 16384 1 0
Still points to lo0. That is interesting. I think at this point you
have to assume packets go over lo0 and firewall there.
I wonder if this is a bug or a feature …
/bz
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?474892D3-A01C-43B2-AF07-E383CD81188E>