Date: Wed, 11 Aug 2010 08:42:32 +0100 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: "Randal L. Schwartz" <merlyn@stonehenge.com> Cc: Fbsd8 <fbsd8@a1poweruser.com>, Brice ERRANDONEA <berrandonea@yahoo.fr>, freebsd-questions@freebsd.org Subject: Re: How to connect a jail to the web ? Message-ID: <4C625468.8010805@infracaninophile.co.uk> In-Reply-To: <86mxsuynm0.fsf@red.stonehenge.com> References: <268321.67123.qm@web24608.mail.ird.yahoo.com> <4C61E8B1.7050605@a1poweruser.com> <86mxsuynm0.fsf@red.stonehenge.com>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigF29B285B69DB1F0750D008EE
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
On 11/08/2010 01:55, Randal L. Schwartz wrote:
>>>>>> "Fbsd8" =3D=3D Fbsd8 <fbsd8@a1poweruser.com> writes:
>=20
> Fbsd8> 2. Using the hosts firewall to drive traffic to a jail is a sign=
> Fbsd8> you have your jail incorrectly configured or do not understand
> Fbsd8> how jails are intended to work.
>=20
> OK, I'll bite. I thought this was the only way to do this. Can you
> elaborate? I'll even accept URL pointers to go read. :)
>=20
Fbsd8's contention is ... contentious. Giving your jail an IP on the
loopback i/f, and then using NAT to redirect traffic for certain
selected ports lets you run services in the jail that need to bind to
some network address but that you never want exposed to the Internet.
Remember, unless you're using VIMAGE, jails don't have a loopback i/f of
their own. VIMAGE is cool, but as it's still incompatible with various
other kernel bits, I don't think it's quite ready for primetime yet.
Yes, you can achieve the same effect using firewall rules, but as I have
occasionally said before, firewalls should be optional -- ideally your
system should be secure even if you turn the firewall off.
Cheers,
Matthew
--=20
Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
JID: matthew@infracaninophile.co.uk Kent, CT11 9PW
--------------enigF29B285B69DB1F0750D008EE
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.14 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkxiVG4ACgkQ8Mjk52CukIxWzgCcDSXNMndPF7iBSJ5nXYv5It8A
nJoAnjdNMq312Za1WrfHPJlznbxkPIPO
=V9pp
-----END PGP SIGNATURE-----
--------------enigF29B285B69DB1F0750D008EE--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4C625468.8010805>