From owner-freebsd-questions@FreeBSD.ORG Tue May 20 22:44:00 2014 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 089D436A for ; Tue, 20 May 2014 22:44:00 +0000 (UTC) Received: from mail-ob0-f176.google.com (mail-ob0-f176.google.com [209.85.214.176]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id C7E952BDC for ; Tue, 20 May 2014 22:43:59 +0000 (UTC) Received: by mail-ob0-f176.google.com with SMTP id wo20so1271002obc.35 for ; Tue, 20 May 2014 15:43:58 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to :content-type; bh=KhED3caqOeU2pYPeSpjAAu4yNybOG6bYWEtFD0BiS20=; b=YzQ2ssIKOu5em/dLPRTkpNaPNCaAwqDDwKWTXST6AtUMew798lFdA0C8UEUccUtSIl xOwlIApo5Sl3/6/ohTCnx72xjDt7HhV8Rcyuuh4jAp849XDiUk4NdrlGCgJN1EPW+on3 zdTVKDoMDT/g7ewTStw11NNc61Wu4q6yVB2cHRyH8a00p0HEyuqilvkWimn53sCdljui 2pALeF4MkYoHRc7kBTqJKsX50HSdcj29Ulzu+MLUIi8xCm21VJ0WV+BBF4aVyuC0bNuN 6786wtDDPfVVXd4jcIOc33QB3kV6i/nSMiQt0DXkMTT4ySc5DMvEP82JHp8lRP+3yU+5 +zAw== X-Gm-Message-State: ALoCoQmPtcGsKOuyXhNb9n10ot/CY6QsuzA8GzmBD3ZG2aCwhpatcnFmebdrmIRSCrcsP2u8pS/f MIME-Version: 1.0 X-Received: by 10.60.146.210 with SMTP id te18mr46109123oeb.44.1400606035210; Tue, 20 May 2014 10:13:55 -0700 (PDT) Received: by 10.76.95.136 with HTTP; Tue, 20 May 2014 10:13:55 -0700 (PDT) Date: Tue, 20 May 2014 18:13:55 +0100 Message-ID: Subject: IPFW loopback interface From: Norman Khine To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.18 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 May 2014 22:44:00 -0000 Hello, I am trying to configure a one IP jail with loopback interface, but I am unsure how to configure the IPFW rules to allow traffic to pass between the jail and the network card on the server. I have followed http://blog.burghardt.pl/2009/01/multiple-freebsd-jails-sharing-one-ip-address/and https://forums.freebsd.org/viewtopic.php?&t=30063 but without success, here is what i have in my ipfw.rules # vim /usr/local/etc/ipfw.rules ext_if="igb0" jail_if="lo666" IP_PUB="192.168.0.2" IP_JAIL_WWW="10.6.6.6" NET_JAIL="10.6.6.0/24" IPF="ipfw -q add" ipfw -q -f flush #loopback $IPF 10 allow all from any to any via lo0 $IPF 20 deny all from any to 127.0.0.0/8 $IPF 30 deny all from 127.0.0.0/8 to any $IPF 40 deny tcp from any to any frag # statefull $IPF 50 check-state $IPF 60 allow tcp from any to any established $IPF 70 allow all from any to any out keep-state $IPF 80 allow icmp from any to any # open port ftp (20,21), ssh (22), mail (25) # ssh (22), , dns (53) etc $IPF 120 allow tcp from any to any 21 out $IPF 130 allow tcp from any to any 22 in $IPF 140 allow tcp from any to any 22 out $IPF 150 allow tcp from any to any 25 in $IPF 160 allow tcp from any to any 25 out $IPF 170 allow udp from any to any 53 in $IPF 175 allow tcp from any to any 53 in $IPF 180 allow udp from any to any 53 out $IPF 185 allow tcp from any to any 53 out # HTTP $IPF 300 skipto 63000 tcp from any to me http,https setup keep-state $IPF 300 skipto 63000 tcp from any to me http,https setup keep-state # deny and log everything $IPF 500 deny log all from any to any # NAT $IPF 63000 divert natd ip from any to any via $jail_if out $IPF 63000 divert natd ip from any to any via $jail_if in but when i create a jail as: # ezjail-admin create -f continental -c zfs node 10.6.6.7 /usr/jails/node/. /usr/jails/node/./etc /usr/jails/node/./etc/resolv.conf /usr/jails/node/./etc/ezjail.flavour.continental /usr/jails/node/./etc/rc.d /usr/jails/node/./etc/rc.conf 4 blocks find: /usr/jails/node/pkg/: No such file or directory Warning: IP 10.6.6.7 not configured on a local interface. Warning: Some services already seem to be listening on all IP, (including 10.6.6.7) This may cause some confusion, here they are: root syslogd 1203 6 udp6 *:514 *:* root syslogd 1203 7 udp4 *:514 *:* i get these warning and then when i go into the jail environment, i am unable to install any ports. any advice much appreciated. -- %>>> "".join( [ {'*':'@','^':'.'}.get(c,None) or chr(97+(ord(c)-83)%26) for c in ",adym,*)&uzq^zqf" ] )