From owner-freebsd-jail@freebsd.org Wed Oct 14 13:36:28 2020
Return-Path: <owner-freebsd-jail@freebsd.org>
Delivered-To: freebsd-jail@mailman.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
by mailman.nyi.freebsd.org (Postfix) with ESMTP id 28851439576
for <freebsd-jail@mailman.nyi.freebsd.org>;
Wed, 14 Oct 2020 13:36:28 +0000 (UTC)
(envelope-from xeper000@gmail.com)
Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com
[IPv6:2607:f8b0:4864:20::d2c])
(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
client-signature RSA-PSS (2048 bits) client-digest SHA256)
(Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK))
by mx1.freebsd.org (Postfix) with ESMTPS id 4CBD2z6776z40rf;
Wed, 14 Oct 2020 13:36:27 +0000 (UTC)
(envelope-from xeper000@gmail.com)
Received: by mail-io1-xd2c.google.com with SMTP id k21so1167973ioa.9;
Wed, 14 Oct 2020 06:36:27 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
h=mime-version:references:in-reply-to:from:date:message-id:subject:to;
bh=Jc+ujoWlPDr95vnmRZoNWKjPZYWGiCz+7HXN/X5oQiQ=;
b=qPnAg6VbBo5scfH33FYc+8O6dzSKRMkC0bvlMC7GOTRbR9BN0GpJRyAhPLHjZMshN5
QZz5NF6sZ8LzIy2hjP2vwdgm725h72r930FfSHsjOAsQiI4Rdzp7YrDKONks4wxTqZjZ
zkWMo4Aqr91/RrWl09fUgyfvCd2dRxJkj7l7Xywo4IEj7sNS7Vv/GBK1C8TvbQ71rueP
STuyTTlVVOd75nMtsNVYdSWphUgM/6yMkmFw7PF8wO3MayjnQCZj5OFlUffWwSjplVtS
D+Cyzjz6iHy7wclrnQEYuuotab9N6kBjJAvq8w2/3iIvmudg4o1T71t5PBMX0akW5Ju7
II2A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:references:in-reply-to:from:date
:message-id:subject:to;
bh=Jc+ujoWlPDr95vnmRZoNWKjPZYWGiCz+7HXN/X5oQiQ=;
b=HVOGxEF37QI6dgroKgIA3UHmujejIJIFCXLHIHy6+FkIwUsRZq+SclLeMfFwgeWb0d
89Oymd16N0zIz+gnAK/97XRXAoR2qOOj/Chjnxs9DoTMGghDgtqAZNhKGLu/PcBIlzyB
26y73boR6qrvHbmYDhfDZXFQeBnXIIeBP9dOkkZnQXLrlmszBeGF+seVUzixsGqIK+9J
XYrvjpXWZecC1f9aZo5GSrOdaysi3bfQTp1Y09/oaOqPhTLhNMPx2kTh1Wa3/ab9tnub
PIY4AADa8is5+x5wVdVxla1UtLH+QdTBb8jnrKKjtNPgevXmUzbW+PTnlHJD+m0itfut
9WOw==
X-Gm-Message-State: AOAM5309v1pdRuqA8eJsgEc/85G2/U0PQshfhFkQcMtmz3Lg216J8o3I
650VCjTfe5OPEQEsscHQhwLZitkg7aTh3zvPegSSP5K3noM=
X-Google-Smtp-Source: ABdhPJycMwKNHTY9PUjcK2Z2V44cA8ag/HG1P928qTa95n4g/p/p2ITipu1dWQksnTv7pHbhMt8fpjhlgs++dcEDSwc=
X-Received: by 2002:a02:7b1d:: with SMTP id q29mr3176702jac.118.1602682584413;
Wed, 14 Oct 2020 06:36:24 -0700 (PDT)
MIME-Version: 1.0
References: <CA+RQ_Fd7Z7ynky8iB5h=cV30oRk5mPw0Out-2c=RF_e-AZVo2A@mail.gmail.com>
<3F8DAE0C-0EA1-40C5-9825-262F547E1954@FreeBSD.org>
In-Reply-To: <3F8DAE0C-0EA1-40C5-9825-262F547E1954@FreeBSD.org>
From: Arsenij Solovjev <xeper000@gmail.com>
Date: Wed, 14 Oct 2020 15:36:12 +0200
Message-ID: <CA+RQ_Fc9HJhuJQe4wxpePe67R+e1XcCDBt9HjVHZA7RQfsOHzg@mail.gmail.com>
Subject: Re: vnet Jail on a non-dedicated network interface
To: kp@freebsd.org, freebsd-jail@freebsd.org
X-Rspamd-Queue-Id: 4CBD2z6776z40rf
X-Spamd-Bar: ----
Authentication-Results: mx1.freebsd.org;
none
X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[];
ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]
Content-Type: text/plain; charset="UTF-8"
X-Content-Filtered-By: Mailman/MimeDel 2.1.33
X-BeenThere: freebsd-jail@freebsd.org
X-Mailman-Version: 2.1.33
Precedence: list
List-Id: "Discussion about FreeBSD jail\(8\)" <freebsd-jail.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-jail>,
<mailto:freebsd-jail-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-jail/>
List-Post: <mailto:freebsd-jail@freebsd.org>
List-Help: <mailto:freebsd-jail-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-jail>,
<mailto:freebsd-jail-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 14 Oct 2020 13:36:28 -0000
On Wed, 14 Oct 2020 at 14:42, Kristof Provost <kp@freebsd.org> wrote:
> On 14 Oct 2020, at 14:18, Arsenij Solovjev wrote:
> > Hi all!
> > Does anybody know if it's possible to run a vnet jail on a
> > non-dedicated
> > interface? I have the Lucas book on jails. In it he says that for vnet
> > you
> > need to pick a dedicated interface, remove all networking IP
> > configuration
> > and only bring it up. Afterwards you set up jib and whatnot.
> >
> > All works well if I use a dedicated secondary interface (let's call it
> > em1). If I use em0 however I cannot ping the jail.
> >
> > I would like to have a host with that has a single network interface
> > which
> > is used for both normal networking stuff as well as having the vnet
> > jail
> > run on it.
> >
> > Maybe I could create some sort of virtual interface and run vnet on
> > it?
> >
> > Any ideas here? Thanks in advance!
> >
> Look at epair interfaces.
>
> You can put em0 and epair0a in a bridge together and add epair0b to the
> vnet jail.
> That gets the vnet jail connected to your LAN.
>
> Or you can skip the bridge, assign an IP to epair0a and route between
> the jail and your LAN.
>
> Regards,
> Kristof
>
Hi Kristof,
Thanks for your reply!
considering your first idea. I did this, the jail gets created seemingly
fine. However I cannot ping the ip of epair0b (this works when using a
dedicated interface).
Also I cannot reach my gateway from within the jail. This too works when
using a dedicated interface.
Btw I have "sysctl security.jail.allow_raw_sockets=1".
Here is my host ifconfig when putting em0 and epair0a in a bridge:
em0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0
> mtu 1500
>
options=812099<RXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,VLAN_HWFILTER>
ether 9a:4c:eb:b5:95:bf
inet 172.18.20.145 netmask 0xffffff00 broadcast 172.18.20.255
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
jailether: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu
> 1500
>
options=81209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,VLAN_HWFILTER>
ether 56:39:b7:c5:2e:ec
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
>
options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
inet 127.0.0.1 netmask 0xff000000
inet 10.43.84.1 netmask 0xffffff00
groups: lo
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
em0bridge: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu
> 1500
>
ether 02:13:0b:48:53:00
id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
member: e0a_sambaad flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 5 priority 128 path cost 2000
member: em0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 1 priority 128 path cost 20000
groups: bridge
nd6 options=1<PERFORMNUD>
e0a_sambaad: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST>
> metric 0 mtu 1500
>
options=8<VLAN_MTU>
ether 02:a4:c4:b5:95:bf
hwaddr 02:78:fd:34:e8:0a
groups: epair
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
Here's the ifconfig from my within my jail:
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
>
options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
inet 127.0.0.1 netmask 0xff000000
groups: lo
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
e0b_sambaad: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0
> mtu 1500
>
options=8<VLAN_MTU>
ether 0e:a4:c4:b5:95:bf
hwaddr 02:78:fd:34:e8:0b
inet 172.18.20.197 netmask 0xffffff00 broadcast 172.18.20.255
groups: epair
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
The rc.conf in my jail contains the following:
ifconfig_e0b_sambaad="172.18.20.197/24"
>
defaultrouter="172.18.20.1"
And last but not least, here's my jail.conf:
Samba-AD_sambaad{
>
allow.mount.devfs="true";
vnet.interface="e0b_sambaad";
exec.prestart="/usr/local/scripts/jib addm sambaad em0";
exec.poststop="/usr/local/scripts/jib destroy sambaad";
sysvshm="new";
sysvmsg="new";
host.hostname="sambaad";
exec.start="'/etc/rc'";
allow.mount.fdescfs="true";
devfs_ruleset="6";
sysvsem="new";
allow.mount.procfs="true";
enforce_statfs="2";
exec.stop="'/etc/rc.shutdown'";
mount.devfs="true";
path="/cs/systemJheap/Samba-AD/j/sambaad/root";
vnet="new";
allow.raw_sockets="true";
allow.mount="true";
}
Do you have an idea why I cannot ping my jail from within my network when
using a non-dedicated interface?
BR
Arsenij