From owner-freebsd-questions@freebsd.org Sat Oct 24 20:45:46 2015 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 5EE3FA1EADE for ; Sat, 24 Oct 2015 20:45:46 +0000 (UTC) (envelope-from niklaas@kulturflatrate.net) Received: from mail2.kulturflatrate.net (mail.financecomm.com [178.63.105.5]) by mx1.freebsd.org (Postfix) with ESMTP id 1F1371157 for ; Sat, 24 Oct 2015 20:45:45 +0000 (UTC) (envelope-from niklaas@kulturflatrate.net) Received: from [10.0.0.38] (mail.kulturflatrate.net [IPv6:2a01:488:66:1000:2ea3:77dd:0:1]) (Authenticated sender: niklaas@kulturflatrate.net) by mail2.kulturflatrate.net (Postfix) with ESMTPSA id 2F263FC67; Sat, 24 Oct 2015 22:45:37 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=kulturflatrate.net; s=default; t=1445719537; bh=dtKbWsU/xbUglazErQdqY4JZL0w+g1ke4NMkYduZGBM=; h=Subject:References:Cc:To:From:Date:In-Reply-To; b=oLNM+Q5BfhiOb7Iu8szcJb3ZBEjQ56mX/KPiIalsBB07nDRkrgwhCotL3f3RyyB1Q DTyU1q6ZzJDOvAe3znew5On+7YCoX+PCF2qTVwo9EOLr/rXjfma7iNq8AYx9hy+WOP 373vbmQoCHbVXstIeH2JtHcnPmIES//Xdc7NYIBc= Subject: Re: IPv6 only Jails cannot connect to the outside world References: <5611AFCA.4010909@kulturflatrate.net> <5611CA44.4030602@radel.com> <56123260.1010901@kulturflatrate.net> <56127D73.5040001@hiwaay.net> <5612E192.6040404@kulturflatrate.net> <56139A43.9010904@kulturflatrate.net> Cc: =?UTF-8?Q?Trond_Endrest=c3=b8l?= To: FreeBSD questions From: Niklaas Baudet von Gersdorff Message-ID: <562BEE8D.1010606@kulturflatrate.net> Date: Sat, 24 Oct 2015 22:48:13 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 Oct 2015 20:45:46 -0000 On 06/10/15 12:15, Trond Endrestøl wrote: > local_unbound is in base, if you prefer to limit the number of > installed ports in each jail. > > Just add local_unbound_enable="YES" to each jail's /etc/rc.conf. > > Start the local_unbound service, and let it create its files in > /var/unbound. Stop the unbound service. > > Edit /var/unbound/forward.conf to your heart's content. Add as many > "forward-addr:" statements as you need below "name: .". See > unbound.conf(5) for more information. > > You might want to verify the settings in /etc/resolv.conf and > /etc/resolvconf.conf. > > Start the unbound service, and check the resolver using host, > ping{,6}, traceroute{,6} ... > > Once you get one jail running as desired, just copy the configuration > files, save /etc/rc.conf, to the other jails. I finally took a closer look on this. Unfortunately, I was not able to set this up within the jails but what I did was installing dns/unbound on the host and set it as IPv4 and IPv6 name server in each jail in `/etc/resolv.conf`. Is there a good reason why not to do this and prefer the local_unbound version in each jail as described by Trond (thanks again)? Maybe because of security concerns? -- Niklaas