From owner-freebsd-jail@freebsd.org Fri Oct 23 20:45:17 2015 Return-Path: Delivered-To: freebsd-jail@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 1AE77A1D825 for ; Fri, 23 Oct 2015 20:45:17 +0000 (UTC) (envelope-from James@Lodge.me.uk) Received: from emea01-am1-obe.outbound.protection.outlook.com (mail-am1on0105.outbound.protection.outlook.com [157.56.112.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client CN "mail.protection.outlook.com", Issuer "MSIT Machine Auth CA 2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 64C7C93D for ; Fri, 23 Oct 2015 20:45:14 +0000 (UTC) (envelope-from James@Lodge.me.uk) Received: from VI1PR06MB1037.eurprd06.prod.outlook.com (10.162.123.156) by VI1PR06MB1038.eurprd06.prod.outlook.com (10.162.123.157) with Microsoft SMTP Server (TLS) id 15.1.306.13; Fri, 23 Oct 2015 20:45:05 +0000 Received: from VI1PR06MB1037.eurprd06.prod.outlook.com ([10.162.123.156]) by VI1PR06MB1037.eurprd06.prod.outlook.com ([10.162.123.156]) with mapi id 15.01.0306.003; Fri, 23 Oct 2015 20:45:05 +0000 From: James Lodge To: "freebsd-jail@freebsd.org" Subject: Re: Freebsd 10.1 - Ezjail - OpenVPN - Tun Interface Thread-Topic: Freebsd 10.1 - Ezjail - OpenVPN - Tun Interface Thread-Index: AQHRDaWCwzvCKcmAUUSD4bPPASu+QJ55WMqAgAABxDKAAA86AIAACF/vgAAUIwCAAAK2PQ== Date: Fri, 23 Oct 2015 20:45:04 +0000 Message-ID: References: <562A7147.5080002@freebsd.org> <562A7F88.4070106@freebsd.org> , <562A9772.5050408@freebsd.org> In-Reply-To: <562A9772.5050408@freebsd.org> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=James@Lodge.me.uk; x-originating-ip: [81.174.132.199] x-microsoft-exchange-diagnostics: 1; VI1PR06MB1038; 5:kMARniIwhxXipCtM7/0PwfVHOXbAz4L3s8hKsSBSKQZxOlqsNEPlVYdHoDRWlINmJibfQNDRvQ3+SfdnZZLjw71Vun1leZvNKFdUbtpfkUneSSnwCi2KLeh3YFd/rmstjupzmE7mw0+w5WV+P12KAQ==; 24:z17BmT/2cI3dbjdO5tiiXHvx1yB2+GLqqzF946+qRWhHU0W3RT4vXbor0F5e+fPl4U2ZdXkanCE7QSeWOrnpJEUcRmc/qK3BbAmn1sZGKWs=; 20:UJvwG8Y+lRpINWJsgwGRUBSSx4TDnBSAersmLW/mpjK0Hktf+uETafVwQeNDYv7TJYMATua3UYJJI2VJJU1TJg== x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(42134001)(42139001); SRVR:VI1PR06MB1038; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(265634631926514); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(8121501046)(520078)(5005006)(3002001)(102215026); SRVR:VI1PR06MB1038; BCL:0; PCL:0; RULEID:; SRVR:VI1PR06MB1038; x-forefront-prvs: 0738AF4208 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(24454002)(53754006)(199003)(377424004)(189002)(105586002)(40100003)(11100500001)(5008740100001)(5001960100002)(189998001)(107886002)(110136002)(10400500002)(5003600100002)(101416001)(77096005)(80792005)(102836002)(87936001)(15975445007)(74482002)(86362001)(2950100001)(5004730100002)(19580395003)(4001150100001)(122556002)(74316001)(50986999)(93886004)(2900100001)(106116001)(5007970100001)(5002640100001)(66066001)(33656002)(106356001)(450100001)(76176999)(81156007)(19580405001)(76576001)(2501003)(54356999)(92566002)(97736004)(2351001); DIR:OUT; SFP:1102; SCL:1; SRVR:VI1PR06MB1038; H:VI1PR06MB1037.eurprd06.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: Lodge.me.uk does not designate permitted sender hosts) spamdiagnosticoutput: 1:23 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: Lodge.me.uk X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Oct 2015 20:45:04.7743 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: ded56ae9-7c77-4cf6-bbfd-39e6a505742d X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR06MB1038 X-BeenThere: freebsd-jail@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Discussion about FreeBSD jail\(8\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Oct 2015 20:45:17 -0000 >On 2015-10-23 15:15, James Lodge wrote: > On 2015-10-23 14:13, James Lodge wrote: >>> On 2015-10-23 11:37, James Lodge wrote: >>> Hello all, >>> >>> >>> I'm trying to build a jail on FreeBSD 10.1 using ezjail in order to run= OpenVPN. I'm not using vimage and don't particularly want to but I'm havin= g an issue with networking. >>> >>> >>> OpenVPN daemon is up and running and I can connect successfully as a cl= ient. I receive an IP address as expected, but I cannot route traffic to/fr= om client/server. The routing table on the client (which is a Windows machi= ne) looks fine so I assume the issue is on the server side. I have a tun in= terface created on the host and exposed to the jail via devfs rules. The IP= address on the tun interface is configure on the host and not from the jai= l. I can ping the tun interface IP from the host and the jail, but not from= the client when connected. >>> >>> >>> Client---------public IP --------- lo1 (Jail alias Interface)------tun0= (OpenVPN Interface) >>> >>> 10.8.06 x.x.x.x 172.16.1.8 = 10.8.0.1 >>> >>> >>> >>> OpenVPN Jail Routing Table: >>> >>> Internet: >>> Destination Gateway Flags Netif Expire >>> 172.16.1.8 link#4 UH lo1 >>> >>> Jail Host Routing Table: >>> Internet: >>> Destination Gateway Flags Netif Expire >>> default x.x.0.1 UGS vtnet0 >>> 10.8.0.0 10.8.0.2 UGS tun0 >>> 10.8.0.1 link#5 UHS lo0 >>> 10.8.0.2 link#5 UH tun0 >>> x.x.0.0/18 link#1 U vtnet0 >>> x.x.x.x link#1 UHS lo0 >>> localhost link#3 UH lo0 >>> 172.16.1.1 link#4 UH lo1 >>> 172.16.1.2 link#4 UH lo1 >>> 172.16.1.3 link#4 UH lo1 >>> 172.16.1.4 link#4 UH lo1 >>> 172.16.1.5 link#4 UH lo1 >>> 172.16.1.6 link#4 UH lo1 >>> 172.16.1.7 link#4 UH lo1 >>> 172.16.1.8 link#4 UH lo1 >>> >>> Client Routing Table: >>> >>> IPv4 Route Table >>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D >>> Active Routes: >>> Network Destination Netmask Gateway Interface Me= tric >>> 0.0.0.0 0.0.0.0 10.8.0.5 10.8.0.6 = 20 >>> 10.8.0.1 255.255.255.255 10.8.0.5 10.8.0.6 = 20 >>> 10.8.0.4 255.255.255.252 On-link 10.8.0.6 = 276 >>> 10.8.0.6 255.255.255.255 On-link 10.8.0.6 = 276 >>> 10.8.0.7 255.255.255.255 On-link 10.8.0.6 = 276 >>> >>> >>> >>> I'm a little stumped as to how to trouble shoot the issue so any help m= uch appreciated. >>> >>> >>> James >>> >>> >>> >>> _______________________________________________ >>> freebsd-jail@freebsd.org mailing list >>> https://lists.freebsd.org/mailman/listinfo/freebsd-jail >>> To unsubscribe, send any mail to "freebsd-jail-unsubscribe@freebsd.org" >>> >> >>> Try running 'tcpdump -i tun0 -n' on the host, while pining from the >>> windows machine, and see if the packets are arriving. >>> >>> -- >>> Allan Jude >> >> >> Thank you Allan, >> >> I should have thought of tcpdump. So traffic is being received at the ho= st from the windows client. >> >> Results from Host tcpdump -i tun0 -n >> >> 18:44:02.464291 IP 10.8.0.6 > 10.8.0.1: ICMP echo request, id 1, seq 105= 77, length 40 >> 18:44:02.605212 IP 10.8.0.6.56054 > 192.168.0.112.80: Flags [S], seq 512= 633761, win 8192, options [mss 1368,nop,nop,sackOK], length 0 >> 18:44:02.872693 IP 10.8.0.6.57441 > 8.8.8.8.53: 44379+ A? dns.msftncsi.c= om. (34) >> 18:44:03.864800 IP 10.8.0.6.57441 > 8.8.8.8.53: 44379+ A? dns.msftncsi.c= om. (34) >> >> After that I thought I'd see if the traffic is reaching the jail. After = allow the jail access to /dev/bpf I get the same results as the host, traff= ic is received. >> >> Results from Jail tcpdump -i tun0 -n >> >> 19:09:11.899714 IP 10.8.0.6.58706 > 8.8.8.8.53: 33345+ A? dns.msftncsi.c= om. (34) >> 19:09:12.728708 IP 10.8.0.6.62332 > 8.8.8.8.53: 22238+ A? dns.msftncsi.c= om. (34) >> 19:09:12.802903 IP 10.8.0.6.58706 > 8.8.8.8.53: 33345+ A? dns.msftncsi.c= om. (34) >> 19:09:13.825053 IP 10.8.0.6.57107 > 212.56.71.30.443: Flags [S], seq 313= 9281876, win 8192, options [mss 1368,nop,wscale 8,nop,nop,sackOK], length 0 >> 19:09:13.981307 IP 10.8.0.6.57108 > 212.56.71.30.443: Flags [S], seq 415= 2048904, win 8192, options [mss 1368,nop,wscale 8,nop,nop,sackOK], length 0 >> 19:09:14.628697 IP 10.8.0.6.57100 > 192.168.0.112.80: Flags [S], seq 310= 7463099, win 65535, options [mss 1368,nop,nop,sackOK], length 0 >> 19:09:14.814392 IP 10.8.0.6.58706 > 8.8.8.8.53: 33345+ A? dns.msftncsi.c= om. (34) >> >> >> Regards >> James >> _______________________________________________ >> freebsd-jail@freebsd.org mailing list >> https://lists.freebsd.org/mailman/listinfo/freebsd-jail >> To unsubscribe, send any mail to "freebsd-jail-unsubscribe@freebsd.org" >> >> >> Can you include the output of 'ifconfig' from inside the jail?, and >> 'netstat -rn' >> >> It looks like the packets are reaching you on tun0 >> >> -- >> Allan Jude > > ifconfig from Jail > ---------------------- > > vtnet0: flags=3D8843 metric 0 mtu= 1500 > options=3D6c03bb > ether 04:01:5d:21:c3:01 > media: Ethernet 10Gbase-T > status: active > > vtnet1: flags=3D8802 metric 0 mtu 1500 > options=3D6c03bb > ether 04:01:5d:21:c3:02 > media: Ethernet 10Gbase-T > status: active > > lo0: flags=3D8049 metric 0 mtu 16384 > options=3D600003 > > lo1: flags=3D8049 metric 0 mtu 16384 > options=3D600003 > inet 172.16.1.8 netmask 0xffffffff > > tun0: flags=3D8051 metric 0 mtu 1500 > options=3D80000 > Opened by PID 9024 > > pflog0: flags=3D141 metric 0 mtu 33160 > > > netstat -rn from Jail > --------------------------- > > Routing tables > > Internet: > Destination Gateway Flags Netif Expire > 172.16.1.8 link#4 UH lo1 > > > Regards > James > > > > > _______________________________________________ > freebsd-jail@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-jail > To unsubscribe, send any mail to "freebsd-jail-unsubscribe@freebsd.org" > > > Look at 'jls' on the host, as your jail doesn't seem to have any IP > addresses on tun0. > > Or, where are you expecting to receive the traffic? > > -- > Allan Jude I expect the traffic to be received within the jail. I find it strange that= I don't see the same IP address as what I see on the host. Could this be a= devfs rule issue? what should I be looking for with jls? ifconfig from host _______________ tun0: flags=3D8051 metric 0 mtu 1500 options=3D80000 inet 10.8.0.1 --> 10.8.0.2 netmask 0xffffffff nd6 options=3D29 Opened by PID 9024 Regards James