From owner-freebsd-questions@FreeBSD.ORG Fri Jul 9 20:58:15 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0B3351065670 for ; Fri, 9 Jul 2010 20:58:15 +0000 (UTC) (envelope-from mlmichael70@gmail.com) Received: from mail-bw0-f54.google.com (mail-bw0-f54.google.com [209.85.214.54]) by mx1.freebsd.org (Postfix) with ESMTP id 8A8588FC0A for ; Fri, 9 Jul 2010 20:58:14 +0000 (UTC) Received: by bwz12 with SMTP id 12so1667755bwz.13 for ; Fri, 09 Jul 2010 13:58:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:subject:content-type :content-transfer-encoding; bh=19OdV63U/exYZPUtmL6egYXiFr7E3Jk65A6O7sDY/yk=; b=I27CPJDqG07ZgUdqPpZhxStnKI8jAi8OZakFLJASYcfhtKOHoVkZPBXIm2FvQQUhEF SyLRFjJ5L9JntWMecnCt1PIiTzOgqKfDItQ7CPtDoChJAFVeb5c25zXQyls3gcSIEaaj 6fOq++FjcCwQSXwObh3snx55yWBpi4hB6/yuE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject :content-type:content-transfer-encoding; b=Fmi2i4GRVGvkncj2v4KABxqmUJRKS240EwwoY6Nh3Ze/DCIkeom63Pa8Nj9eT4NLDn XW8UErm0V0YRQ0KCJEPytUg5y23aWLs/JmLo7rfEe44LFp9JQWEaDDBMeFP12ya9PohD kpHK56iS3JLyWvLzmpgXp1eeCJfUNA4k8cYAw= Received: by 10.204.25.145 with SMTP id z17mr7962528bkb.104.1278709081886; Fri, 09 Jul 2010 13:58:01 -0700 (PDT) Received: from prime.local (94-193-57-116.zone7.bethere.co.uk [94.193.57.116]) by mx.google.com with ESMTPS id bq20sm5350132bkb.4.2010.07.09.13.58.01 (version=SSLv3 cipher=RC4-MD5); Fri, 09 Jul 2010 13:58:01 -0700 (PDT) Message-ID: <4C378D58.5010404@gmail.com> Date: Fri, 09 Jul 2010 21:58:00 +0100 From: Michael User-Agent: Mozilla/5.0 (X11; U; FreeBSD amd64; en-US; rv:1.9.1.10) Gecko/20100628 Thunderbird/3.0.5 MIME-Version: 1.0 To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: ipfw nat and jails on loopback - is it possible? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Jul 2010 20:58:15 -0000 Hello. Does anybody has a working configuration with ipfw nated jails on loopback interface? It simply doesn't work on my system. I can not get any connections to outside world from within a jail. FreeBSD 8.0-p3 amd64 laptop connected to internet via wlan0 (ath0) with 192.168.1.111 address. Jail with IP 127.127.127.1 aliased on lo0. Host system configuration: /etc/rc.conf ifconfig_wlan0="WPA DHCP" ifconfig_lo0_alias0="inet 127.127.127.1 netmask 255.255.255.255" gateway_enable="YES" firewall_enable="YES" firewall_script="/etc/ipfw.rules" firewall_nat_enable="YES" firewall_nat_interface="wlan0" /etc/resolve.conf nameserver 208.67.222.222 nameserver 208.67.220.220 /etc/ipfw.conf ipfw -q -f flush ipfw add 00001 allow all from 127.0.0.1 to 127.0.0.1 via lo0 ipfw add 00002 nat 100 ip from 127.127.127.1 to any via wlan0 keep-state ipfw nat 100 config ip 192.168.1.111 ipfw add 00003 allow all from any to any Jailed system configuration: /etc/rc.conf network_interfaces="" /etc/resolve.conf nameserver 208.67.222.222 nameserver 208.67.220.220 Now I'm doing ssh into a jailed system (127.127.127.1). Then on jail system I'm trying to do for example: host freebsd.org ;; connection timed out; no servers could be reached And on host system: ipfw -d show 00001 0 0 allow ip from 127.0.0.1 to 127.0.0.1 via lo0 00002 4 228 nat 100 ip from 127.127.127.1 to any via wlan0 keep-state 00003 182 24627 allow ip from any to any 65535 0 0 deny ip from any to any ## Dynamic rules (2): 00002 1 57 (1s) STATE udp 127.127.127.1 58340 <-> 208.67.222.222 53 00002 1 57 (2s) STATE udp 127.127.127.1 39870 <-> 208.67.220.220 53 So no packets got blocked but still it doesn't work properly. I'm trying to get it working for couple weeks now and I'm afraid I just run out of ideas so any help would be very appreciated. Michael