Date: Tue, 16 Aug 2016 16:21:26 -0400 From: Ernie Luzar <luzar722@gmail.com> To: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net> Cc: krad <kraduk@gmail.com>, "freebsd-jail@freebsd.org" <freebsd-jail@freebsd.org>, Freebsd Questions <FreeBSD-questions@freebsd.org> Subject: Re: testing 11.0-RC1 vnet jails with ipfilter Message-ID: <57B375C6.9030500@gmail.com> In-Reply-To: <F610E6D1-6622-4E15-98B4-F7AD58EEA9CF@lists.zabbadoz.net> References: <57B1E1BC.4090205@gmail.com> <078403E1-D8A3-4E52-B218-7A8B4400749A@lists.zabbadoz.net> <CALfReyeR_4pM6FsrFZxTbHNoC1_yd3SZW72Ze9Bo354itzEgWQ@mail.gmail.com> <F610E6D1-6622-4E15-98B4-F7AD58EEA9CF@lists.zabbadoz.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Bjoern A. Zeeb wrote: > > In 11-RC* it is present for all 3 firewalls; like VIMAGE due to memory > footprint you might have to compile the firewall into the kernel rather > than kldload it (especially ipfilter). > > /bzvnet The 11.0-RC1 host has vimage and ipfilter compiled into the kernel. Vnet jail can ping public network. Host ipf log shows pings from vnet jail as they pass the host firewall on external interface using the ip address assigned to the vnet jail. Codding rules on the host firewall using the vnet jail's assigned ip address does work. But this is not what vimage literature says how vnet firewalls are suppose to work. Issuing "ipf -FS -Fa" command from within the vnet jail gives this message, "open device:no such file or directory. User kernel version check failed. Issuing "ipfstat -hnio command from within the vnet jail gives this message, open(IPSTATE_NAME):no such file or directory. Running the host on a kernel with just vimage compiled in gets same results as above. Only differences between 10.x systems and 11.0 is a vimage kernel no longer panics if the host is running ipfilter and the lost memory message at stopping a vimage jail is gone. Ipfilter does NOT start in a vimage jail. This is a major show stopper.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?57B375C6.9030500>