From owner-freebsd-questions@FreeBSD.ORG Tue Jul 8 19:54:33 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E33A110656F0 for ; Tue, 8 Jul 2008 19:54:33 +0000 (UTC) (envelope-from the.real.david.allen@gmail.com) Received: from ti-out-0910.google.com (ti-out-0910.google.com [209.85.142.184]) by mx1.freebsd.org (Postfix) with ESMTP id 6AA9E8FC12 for ; Tue, 8 Jul 2008 19:54:33 +0000 (UTC) (envelope-from the.real.david.allen@gmail.com) Received: by ti-out-0910.google.com with SMTP id d27so870782tid.3 for ; Tue, 08 Jul 2008 12:54:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=joPJ+8FloFYqHMgbUsbIRwwdknhcUQc5kH8nEnewL/8=; b=Y/hjo/+OyRO5fiQNfucRhn8EMmfmqBm8IkhxMoOSWfXiQvZvxktvuRe8EBqhmPDU51 LK61XTNZKY48HMNZlxBCykIoIQ1PkNwyxdnWBu34F7J1/hHo1I4y/JyrKmnpXtfkMCUh 8qx11XzGJXMEwGdsOiDT2sg37lR/uHDosmLU4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=Hkm5ZiUPJ/BXz5xJ/gPYl/J8BZf8VjWYgRDNG/3lRdEc4AkuikR3cJjmtzJv1wmsew 6KZeNoyrFEYsvC57/gj8cFkZXSI+hLrZku4oQDElFuw1ax137viFKL1dI1tvvtSekZ7H FpynWXJRNqVJQLWPw3KFgWYrUCPXbrMABPTZs= Received: by 10.150.123.16 with SMTP id v16mr10974845ybc.5.1215546870857; Tue, 08 Jul 2008 12:54:30 -0700 (PDT) Received: by 10.151.111.10 with HTTP; Tue, 8 Jul 2008 12:54:30 -0700 (PDT) Message-ID: <2daa8b4e0807081254x44d954c4s7c7d4fc09ffb881@mail.gmail.com> Date: Tue, 8 Jul 2008 12:54:30 -0700 From: "David Allen" To: "Matthew Seaman" In-Reply-To: <4873973D.1080402@infracaninophile.co.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <2daa8b4e0807070951u607ff031v98b5b96103fdab4@mail.gmail.com> <200807081124.33377.fbsd.questions@rachie.is-a-geek.net> <2daa8b4e0807080903o609d6b7ag831845b7939c20c8@mail.gmail.com> <4873973D.1080402@infracaninophile.co.uk> Cc: Mel , freebsd-questions@freebsd.org Subject: Re: Jails and IP Aliasing X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Jul 2008 19:54:34 -0000 On Tue, Jul 8, 2008 at 9:35 AM, Matthew Seaman wrote: > David Allen wrote: > >> There was a post recently (Matthew Seaman's name comes to mind) that >> suggested binding jails to addresses in the loopback range and then >> using firewall rules to redirect the traffic accordingly. There's a >> possibility that may help in this case, but that layer of added >> complexity isn't much of an improvement over seeing connections with >> seemingly identical endpoints and interpreting the results in my head. > > Guilty as charged M'lud. Stand up, fool, lest I be forced to lower my knee and acknowledge your presence in a manner befitting a man as yourself. > However what I recommended was a more-than-slightly hacky way to achieve > three things: > > * Something like a loopback address inside the jail. It may be > 127.0.0.2 instead of 127.0.0.1 but most software can be persuaded > to use it for loopback style things. > > * The ability to map several IPs onto the jailed system by use of > NAT and redirect within firewall rules > > * The ability to have a jail with /no/ external IP for when the > paranoia becomes unbearable[*]. It could be said that those three expand into more numerous achievements. I'm still debating the "more-than-slightly hacky" aspects of such an arrangement, but undeniably it's interesting enough. > Of course, all this will be immediately obsoleted by Marco Zec's work > on virtualizing the IP stack. http://imunes.tel.fer.hr/virtnet/ Promising, even exciting, but I'm having trouble deciding whether I declare a victory for the triumph of optimism over experience, or offer the comment that the Real Soon Now schedule is a disappointment? Seriously, though, jails can be seen as the greatest thing since slide bread, but I have this nagging feeling I'm at work writing a small book that details their niggly shortcomings, a book whose completion, I hope, will be cut short by the addition of New and Improved features.