Date: Fri, 29 Jan 2010 09:24:16 +0000 (UTC) From: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net> To: "tom@diogunix.com" <tom@diogunix.com> Cc: freebsd-jail@freebsd.org Subject: Re: configuration of multiple IPs for a jail Message-ID: <20100129091822.O50938@maildrop.int.zabbadoz.net> In-Reply-To: <201001282351.13267.tom@diogunix.com> References: <201001270308.21674.tom@diogunix.com> <4B6211C7.6010404@beardz.net> <201001282351.13267.tom@diogunix.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 28 Jan 2010, tom@diogunix.com wrote: Hi, > Jase, > >> This behaviour has been addressed in RELENG_7 recently with r202924 [1]. > > thank you very much. That's what I was watching out for :-). > I somehow could not find that hint in all the resources I used. > >> This commit allows you to set : sysctl security.jail.ip4_saddrsel 0 , >> which makes the kernel use the first IP passed to jail (8) as the >> default source address instead of the default behaviour which picks the >> first matching ip for that jail on the interface. That's not exactly true. Source address uses the first "matching" address for the destination on the outgoing interface if possible. There is a route lookup involved as well. So if you are serving more than one subnet it won't necessarily be the first IP of the interface seen within the jail. For the case given, it most likely will, though. > Just great. I run 7.2 stable on most machines and thanks to your information > it will be much easier than what I meanwhile did to fix things. > >> A workaround (if you're not able to update to a RELENG_7 following that >> commit) is to reorder your interface aliases in /etc/rc.conf ,so that >> your primary jail ip has a lower alias # than any secondary ips for that >> jail. > > Yes. I've meanwhile found exactly that out the hard way and by trial and > error. Works nice (or however, it works), even when the kernel setting method > of course is much more elegant. > >> Hope this helps, > > I did already. Though it might help, if you only need it for postfix, using the smtp_bind_address (and smtp_bind_address6) options might be more elegant rather than using the hammer of forcing things in the kernel. See man 5 postconf. If more services across all jails should be using the intended behavior using the sysctl and kernel is probably the right thing. /bz -- Bjoern A. Zeeb It will not break if you know what you are doing.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20100129091822.O50938>