Date: Sat, 29 Mar 2014 11:07:28 -0700 From: Matt Lager <matt@soliddataservices.com> To: freebsd-pf@freebsd.org Subject: Re: Controlling traffic between jails on the same host Message-ID: <53370BE0.20806@soliddataservices.com> In-Reply-To: <533692E0.6000104@gmail.com> References: <53366B85.3020002@soliddataservices.com> <533692E0.6000104@gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
That was it, lo0 was the answer and I had set skip on lo0. For some reason, that's in every freaking pf.conf example out there so I never gave it a second thought. Thanks :) On 3/29/2014 2:31 AM, Mikal Sande wrote: > On 03/29/2014 07:43 AM, Matt Lager wrote: >> The Setup: I've got a pretty simple setup... A FreeBSD 10.0 host with >> 3 jails on it. The host, and each jail are assigned a public IP >> address. The host runs PF that controls inbound and outbound traffic >> for itself and it's jails. All works really nicely. Here's a basic >> diagram: >> >> PF does a really good job controlling traffic to and from remote >> system. I have recently come across the need to limit traffic from >> jails on the host to other jails on the same host. I.E. HostA-JailA >> needs to not be able to communicate with HostA-JailB. What I am >> seeing, however, is that because all these jails share a single >> interface, the traffic must not be going through PF as it is just >> seen as local traffic. >> >> I briefly tried to bring up a jail on another interface (lo1 for >> example) and use NAT to provide it with its connectivity, but even >> then the local traffic was still not filterable. >> >> There's got to be a way, but my brain hasn't thought of it yet. Any >> advice would be amazing, thanks so much ahead of time! >> >> --Matt >> > Do you have rules that allow all traffic on loopback, or do you have > 'set skip on lo0' or something in your pf.conf? I had the latter set > last time I tried to limit traffic between jails, it took me a little > time to realize it. > _______________________________________________ > freebsd-pf@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-pf > To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org" > -- Solid Data Services <http://www.soliddataservices.com>; Matt Lager / President *Office:* 480-351-5122 *Mobile:* 501-269-8606 www.SolidDataServices.com <http://www.soliddataservices.com>; This e-mail message may contain confidential or legally privileged information and is intended only for the use of the intended recipient(s). Any unauthorized disclosure, dissemination, distribution, copying or the taking of any action in reliance on the information herein is prohibited. E-mails are not secure and cannot be guaranteed to be error free as they can be intercepted, amended, or contain viruses. Anyone who communicates with us by e-mail is deemed to have accepted these risks. Solid Data Services is not responsible for errors or omissions in this message and denies any responsibility for any damage arising from the use of e-mail. Any opinion and other statement contained in this message and any attachment are solely those of the author and do not necessarily represent those of the company. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?53370BE0.20806>