From owner-freebsd-jail@freebsd.org Tue Jan 5 21:39:46 2021 Return-Path: Delivered-To: freebsd-jail@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id DEF384CB9A1 for ; Tue, 5 Jan 2021 21:39:46 +0000 (UTC) (envelope-from me+freebsd@igalic.co) Received: from mail-40133.protonmail.ch (mail-40133.protonmail.ch [185.70.40.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "protonmail.com", Issuer "SwissSign Server Gold CA 2014 - G22" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4D9QrJ1Kydz3MPQ for ; Tue, 5 Jan 2021 21:39:43 +0000 (UTC) (envelope-from me+freebsd@igalic.co) Date: Tue, 05 Jan 2021 21:39:27 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=igalic.co; s=protonmail2; t=1609882775; bh=kkaBlY3s+JAQk3q0nMqLvIEaf2JUz3nIc7DlLeRdf+Y=; h=Date:To:From:Cc:Reply-To:Subject:In-Reply-To:References:From; b=ZXrZhOaPnCqHUSv8siNtYTR26NH/1xa7rpvFDG0i9vV8kdgrFC8fIfwcoIOPVuArv rdeeNs6kzUtLdwgB+vVHukMhfwGCUe858vf9tAi66C88oSORwHX47YQ8h0vaTBdmRq smNu4wDjSWoWyHtW3qBCyFQO9gtz0whs36JWlIwAYcyaAUwF23a9IrsgK3MhNY+39a xAF3+kM8PRCLV9AGZLkOwtD/cvrZqXjB2UtTkujiKKrSUGVe+GlwHuP88IIyAf2w6u q94rK7Ga859+0wSaruTkZdHxcdEZih9EPjMTD+I1geLVhS1a0WUj/XXD+71Ma+aHoD ZOJrpvEEYAupw== To: Jacques Foucry From: =?utf-8?Q?Mina_Gali=C4=87?= Cc: freebsd-jail@freebsd.org Reply-To: =?utf-8?Q?Mina_Gali=C4=87?= Subject: Re: Need help with VNET, Jail and IPv6 Message-ID: In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Status: No, score=1.8 required=10.0 tests=ALL_TRUSTED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NEW_DOMAIN_28D, URIBL_FRESH_28D_SURBL shortcircuit=no autolearn=disabled version=3.4.4 X-Spam-Level: * X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on mailout.protonmail.ch X-Rspamd-Queue-Id: 4D9QrJ1Kydz3MPQ X-Spamd-Bar: --- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=igalic.co header.s=protonmail2 header.b=ZXrZhOaP; dmarc=none; spf=pass (mx1.freebsd.org: domain of me@igalic.co designates 185.70.40.133 as permitted sender) smtp.mailfrom=me@igalic.co X-Spamd-Result: default: False [-3.50 / 15.00]; HAS_REPLYTO(0.00)[me+freebsd@igalic.co]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip4:185.70.40.0/24]; DKIM_TRACE(0.00)[igalic.co:+]; RCPT_COUNT_TWO(0.00)[2]; NEURAL_HAM_SHORT(-1.00)[-1.000]; RCVD_COUNT_ZERO(0.00)[0]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; RBL_DBL_DONT_QUERY_IPS(0.00)[185.70.40.133:from]; ASN(0.00)[asn:62371, ipnet:185.70.40.0/24, country:CH]; MID_RHS_MATCH_FROM(0.00)[]; TAGGED_FROM(0.00)[freebsd]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; R_DKIM_ALLOW(-0.20)[igalic.co:s=protonmail2]; REPLYTO_EQ_FROM(0.00)[]; FROM_HAS_DN(0.00)[]; FREEFALL_USER(0.00)[me]; NEURAL_HAM_LONG(-1.00)[-1.000]; TAGGED_RCPT(0.00)[freebsd]; MIME_GOOD(-0.10)[text/plain]; DMARC_NA(0.00)[igalic.co]; SPAMHAUS_ZRD(0.00)[185.70.40.133:from:127.0.2.255]; TO_MATCH_ENVRCPT_SOME(0.00)[]; MAILMAN_DEST(0.00)[freebsd-jail] X-BeenThere: freebsd-jail@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: "Discussion about FreeBSD jail\(8\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Jan 2021 21:39:46 -0000 > Hello all, Hi Jacques, > On my hosted machine I already have many "classical" jails. > > But I would like to switch to modern schema with Bridge and vnet. > > With IPv4 I have no problem. In fact is almost like without Bridge/VNET: For: https://alpha.pkgbase.live/ instead of libioc I just used jail.conf. With: https://antranigv.am/weblog_en/posts/vnet-jail-howto/ as basis for the IPv4 setup. > My goal is first to have on jail (myjail) working with IPv4 and IPv6 then= , > > slowly migrate the old jail to the new way. > > So, I need help to configure myjail to have IPv6 working: > > - configure a IPv6 on e0b_myjail is easy, but which defaultrouter6 did = I use? > - did the bridge have an IPv6 to be the defaultrouter6? I try with no l= uck. > - did I need some configuration on PF? > > Thanks for reading me (I sure I not really clear) and for your advice= . > > Btw, after I successfully configure myjail (and the other one) I will= wrote a how-to. > Okay, let's see if I can hit all beats: Here's the paste of webserver.jail.conf, rc.conf (highlights) and pf.conf https://gist.github.com/87ba10c1c5611ed32367d5d48ef5f402 I'll explain some of the important bits: my ISP binds the IPv4 to the MAC, but not the IPv6, go figure. That's why I leave the IPv4 address on the main interface, instead of fiddl= ing with MAC addresses and moving it to the bridge. On the bridge, we have the IPv6 and the IPv4 NAT; That's handy, as it also = means we only need one interface for both IPv4 and IPv6. cloned_interfaces=3D"bridge0" # jail NAT and Network access ifconfig_bridge0=3D"inet 192.168.17.1/24" gateway_enable=3D"YES" note that we explicitly enable link-local addresses, because, as per spec, = they are needed to make IPv6 work: # working IPv6 setup needs link-local addresses (according to the spec) ipv6_activate_all_interfaces=3D"YES" ifconfig_bridge0_ipv6=3D"inet6 2a01:4f9:c010:c64c::1/64 auto_linklocal" ipv6_defaultrouter=3D"fe80::1%vtnet0" # enable IPv6 gateway ipv6_gateway_enable=3D"YES" and in the jail.conf it's really just about adding the IPv6 addresses to th= e interfaces, too! vnet.interface =3D "$jepair"; exec.prestart =3D "ifconfig epair${id} create up"; exec.prestart +=3D "ifconfig epair${id}a up descr vnet-${name}"; exec.prestart +=3D "ifconfig $bridge addm epair${id}a up"; exec.start =3D "/sbin/ifconfig lo0 127.0.0.1 up"; exec.start +=3D "/sbin/ifconfig epair${id}b ${ipaddr}"; exec.start +=3D "/sbin/ifconfig epair${id}b inet6 ${ip6addr}"; exec.start +=3D "/sbin/route add default ${gw}"; exec.start +=3D "/sbin/route add -inet6 default ${gw6}"; exec.start +=3D "/bin/sh /etc/rc"; I also highly recommend adding IPv6 nameservers to your resolv.conf; that w= ay, if you broke your IPv4 setup, you still have working IPv6! Being NAT, IPv4 routing is obviously happening via the host. Aaaaand, given that my ISP uses fe80::1 as the default gateway, the only wa= y to make jails' IPv6 routing work was by routing it thru the host. as for pf, it's only used for NAT. No firewalling, and I'm not doing anything to IPv6. That's all from me, i hope it helps. > -- > > Jacques Foucry best of luck, Mina