Date: Fri, 10 Feb 2006 11:37:25 +0100 (CET) From: Oliver Fromme <olli@lurza.secnetix.de> To: freebsd-stable@FreeBSD.ORG Subject: Re: OpenVPN within a Jail under 6.x ... Message-ID: <200602101037.k1AAbPw9057206@lurza.secnetix.de> In-Reply-To: <43EC4E88.2070009@geminix.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Uwe Doering <gemini@geminix.org> wrote: > Oliver Fromme wrote: > > Uwe Doering <gemini@geminix.org> wrote: > > [...] > > > Now, since routes are a global resource in FreeBSD, is there a way to > > > prevent users from other jails on that machine from accessing that VPN, > > > too? If it weren't possible to restrict access to a VPN to the jail it > > > is associated with the VPN would no longer be private I'd think. > > > > Every jail has its own IP address. Connections originating > > from a jail are forced to use the jail's IP address as their > > source address. Therefore you can use a packet filter (IPFW > > or PF) to control where those packets are allowed to go. > > [...] > > Thanks for pointing that out. I must admit that I hadn't thought this > through very thoroughly. Now that you mention the fixed nature of a > jail's IP address it is kind of obvious that you can filter on the > source address. > > However, I believe there is still a snag. People tend to pick the same > IP networks from the range of official private IP addresses for their > internal LANs. If you wanted to set up VPN tunnels to these LANs for a > larger number of jails belonging to individual "owners" there is some > likelihood that the routes to these LANs would overlap. Yes, but that's a more generic problem. When you connect various LANs (no matter if by VPN tunnels or other means), then you should make sure that their addresses don't overlap. It's a question of careful planning and design. If you manage such a set of LANs, make sure that you assign different address ranges to each of them. > That is, since > you cannot _route_ based on the source address of IP packets, Well, you can. At least to some extent, routing by source IP can be accomplished using IPFW's FWD feature. However, that doesn't help much when you need to connect networks with overlapping address ranges. IP addresses are required to uniquely identify a machine. If you have overlapping LANs, it's not possible anymore to uniquely identify a machine by IP number, no matter what you do. That problem exists independently of VPNs and jails. Best regards Oliver -- Oliver Fromme, secnetix GmbH & Co. KG, Marktplatz 29, 85567 Grafing Dienstleistungen mit Schwerpunkt FreeBSD: http://www.secnetix.de/bsd Any opinions expressed in this message may be personal to the author and may not necessarily reflect the opinions of secnetix in any way. "I made up the term 'object-oriented', and I can tell you I didn't have C++ in mind." -- Alan Kay, OOPSLA '97
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200602101037.k1AAbPw9057206>