Date: Wed, 18 Mar 2020 22:50:46 +0700 From: Victor Sudakov <vas@sibptus.ru> To: Miroslav Lachman <000.fbsd@quip.cz> Cc: freebsd-questions@freebsd.org, freebsd-net@freebsd.org Subject: Re: IPv6 in jails Message-ID: <20200318155046.GD65497@admin.sibptus.ru> In-Reply-To: <2dd539ed-0ee3-079b-27b2-28126056c69a@quip.cz> References: <20200318151556.GA64871@admin.sibptus.ru> <2dd539ed-0ee3-079b-27b2-28126056c69a@quip.cz>
next in thread | previous in thread | raw e-mail | index | archive | help
--hoZxPH4CaxYzWscb
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Miroslav Lachman wrote:
> Victor Sudakov wrote on 2020/03/18 16:15:
> >=20
> > Is IPv6 in jails supposed to work? Does not work for me, what am I doing
> > wrong?
> >=20
> > Here is a test jail:
> >=20
> > test4 {
> > path =3D /d02/jails/test4 ;
> > mount.devfs;
> > ip4 =3D new;
> > ip6 =3D new;
> > ip4.addr =3D 192.168.4.204/24;
> > ip6.addr =3D 2001:470:ecba:3::4/64;
> > host.hostname =3D test4.vas.sibptus.ru ;
> > interface =3D re1 ;
> > allow.raw_sockets =3D true ;
> > exec.start =3D "/bin/sh /etc/rc";
> > exec.stop =3D "/bin/sh /etc/rc.shutdown";
> > }
> >=20
> > However when I look from inside the jail, I see the daemons listening
> > only on IPv4:
> >=20
> > root@test4:/ # sockstat -l
> > USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRE=
SS
> > root sendmail 17178 3 tcp4 192.168.4.204:25 *:*
> > root sshd 17175 3 tcp4 192.168.4.204:22 *:*
> > root syslogd 17110 5 udp4 192.168.4.204:514 *:*
> >=20
> > If I "ssh 2001:470:ecba:3::4" from outside, I get into the host instead
> > of the jail (because 2001:470:ecba:3::4 *is* assigned to re1, but not
> > available inside the jail).
>=20
> If sshd in the host is configured to listen on all available interfaces a=
nd
> addresses (the default) then it will catch your jails IP too.
Why is it not catching the 192.168.4.204 address then?=20
> You must configure sshd in the host to listen only on hosts IP and then y=
ou
> will connect to the jails sshd.
OK, I've stopped the sshd on the host entirely, and restarted the jails.
Why am I still not seeing the jailed sshd listening on tcp6?
root@test4:/ # sockstat -l
USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN
ADDRESS
root sendmail 17995 3 tcp4 192.168.4.204:25 *:*
root sshd 17992 3 tcp4 192.168.4.204:22 *:*
root syslogd 17927 5 udp4 192.168.4.204:514 *:*
root syslogd 17927 6 dgram /var/run/log
root syslogd 17927 7 dgram /var/run/logpriv
root@test4:/ #=20
Your theory is probably incorrect.
>=20
> What is you sshd_config in the host and in the jail?=20
The sshd on the host has been stopped now.
The sshd_config in the jail is the FreeBSD default one.
--=20
Victor Sudakov, VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/
--hoZxPH4CaxYzWscb
Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQEcBAEBAgAGBQJeckNWAAoJEA2k8lmbXsY0GlcH/1w2bskTWY3duh53t9LvX93I
+im9ZQI0Tj69tTFARZHID/moLOm5SaVfveMrWhOx63cljxOPmQ2ehwoteGLOPqBy
lL30FEo0oLfFDP43Il287QlZMoqS/VrBwBLJrIYNqymjkY3Jc0OXtTqWRvSr5RT+
AUveXx5OOETjFHyeAKxsl4ALk+cgWPI2rdduTbaiKjmuVsyuskOIitnc/3SLhy3H
nYt8iAYAdnt1qSGmjdjuH93N8fi1YCFuWve1FEuevT2VF13KvSYYFpJEAm1b9ZGe
DQV7RJIH3TFCCa5/FuPZMs1yDhbEY1LqoJHNydGMUUa/sEu+/OiJ1+Z1ZDcW02g=
=E7MI
-----END PGP SIGNATURE-----
--hoZxPH4CaxYzWscb--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20200318155046.GD65497>