From owner-freebsd-jail@FreeBSD.ORG Tue Nov 17 10:45:07 2009 Return-Path: Delivered-To: freebsd-jail@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E14EE106566C for ; Tue, 17 Nov 2009 10:45:07 +0000 (UTC) (envelope-from bzeeb-lists@lists.zabbadoz.net) Received: from mail.cksoft.de (mail.cksoft.de [IPv6:2001:4068:10::3]) by mx1.freebsd.org (Postfix) with ESMTP id 735038FC0A for ; Tue, 17 Nov 2009 10:45:07 +0000 (UTC) Received: from localhost (amavis.fra.cksoft.de [192.168.74.71]) by mail.cksoft.de (Postfix) with ESMTP id 0898341C750; Tue, 17 Nov 2009 11:45:06 +0100 (CET) X-Virus-Scanned: amavisd-new at cksoft.de Received: from mail.cksoft.de ([192.168.74.103]) by localhost (amavis.fra.cksoft.de [192.168.74.71]) (amavisd-new, port 10024) with ESMTP id saXruWhBq63q; Tue, 17 Nov 2009 11:45:05 +0100 (CET) Received: by mail.cksoft.de (Postfix, from userid 66) id 7DCFE41C75A; Tue, 17 Nov 2009 11:45:05 +0100 (CET) Received: from maildrop.int.zabbadoz.net (maildrop.int.zabbadoz.net [10.111.66.10]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.int.zabbadoz.net (Postfix) with ESMTP id D51654448E6; Tue, 17 Nov 2009 10:40:54 +0000 (UTC) Date: Tue, 17 Nov 2009 10:40:54 +0000 (UTC) From: "Bjoern A. Zeeb" X-X-Sender: bz@maildrop.int.zabbadoz.net To: "Scheithauer, Lars (FH)" In-Reply-To: <26040005B7F3AA41A0345BCE386CA09701C62A7A@FHCLUSRV-EX.dcs.fh-heidelberg.de> Message-ID: <20091117103601.G37440@maildrop.int.zabbadoz.net> References: <26040005B7F3AA41A0345BCE386CA09701C62A79@FHCLUSRV-EX.dcs.fh-heidelberg.de> <26040005B7F3AA41A0345BCE386CA09701C62A7A@FHCLUSRV-EX.dcs.fh-heidelberg.de> X-OpenPGP-Key: 0x14003F198FEFA3E77207EE8D2B58B8F83CCF1842 MIME-Version: 1.0 Content-Type: MULTIPART/MIXED; BOUNDARY="0-1639566562-1258454454=:37440" Cc: freebsd-jail@freebsd.org Subject: Re: Networking from jail - errata X-BeenThere: freebsd-jail@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Discussion about FreeBSD jail\(8\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 10:45:08 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --0-1639566562-1258454454=:37440 Content-Type: TEXT/PLAIN; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: QUOTED-PRINTABLE On Tue, 17 Nov 2009, Scheithauer, Lars (FH) wrote: Hi, > Quick note: > Forgot to replace two values. > Jail - x.y.z.61 > Host - x.y.z.60 > Router - x.y.z.62 > > > -----Urspr=FCngliche Nachricht----- > Von: owner-freebsd-jail@freebsd.org [mailto:owner-freebsd-jail@freebsd.or= g] Im Auftrag von Scheithauer, Lars (FH) > Gesendet: Dienstag, 17. November 2009 10:19 > An: freebsd-jail@freebsd.org > Betreff: Networking from jail > > Hi everyone! > > I'm having a little trouble with my jail's networking and I'm not sure > what to make of it. > > My jailhost has an IP of x.y.z.48, my test jail is x.y.z.49. The > jailhost has both IP-adresses, the jail has just it's own: > > Jail# ifconfig > bce0: flags=3D8843 metric 0 mtu > 1500 > > options=3D1bb TSO4> > ether xx:xx:xx:xx:xx:10 > inet x.y.z.60 netmask 0xffffffc0 broadcast x.y.z.63 > media: Ethernet autoselect (1000baseSX ) > status: active > [...] > Host# ifconfig > bce0: flags=3D8843 metric 0 mtu > 1500 > > options=3D1bb TSO4> > ether xx:xx:xx:xx:xx:10 > inet x.y.z.61 netmask 0xffffffc0 broadcast x.y.z.63 > inet x.y.z.60 netmask 0xffffffc0 broadcast x.y.z.63 > media: Ethernet autoselect (1000baseSX ) > status: active > [...] > > I am able to access the ssh-server running on the jail, and I am able to > access the proxyserver of our network via telnet and get some pages of > the internet. However, if I want to install something from the ports, > the jail is unable to fetch it: > > Jail# cd /usr/ports/ftp/wget > Jail# make > =3D=3D=3D> Vulnerability check disabled, database not found > =3D=3D=3D> Found saved configuration for wget-1.11.4_1 > =3D> wget-1.11.4.tar.bz2 doesn't seem to exist in /usr/ports/distfiles/. > =3D> Attempting to fetch from http://ftp.gnu.org/gnu/wget/. > fetch: http://ftp.gnu.org/gnu/wget/wget-1.11.4.tar.bz2: Operation timed > out > =3D> Attempting to fetch from ftp://ftp.gnu.org/gnu/wget/. > [...] > > I've set the appropriate environment variables HTTP_PROXY, HTTPS_PROXY > and FTP_PROXY. If I test the connection with netcat, I get the following > error message: > # nc -zvw 1 -x 'proxy.example.com:8080' www.freebsd.org 80 > nc: read failed (0/3): Broken pipe The usual thing I am interested at that point is - does name resolution work properly from within the jail? /etc/resolv.conf setup correctly etc? > The funny thing is, that I have no problem installing ports from the > Host-system. From what I can tell, all the config files are correct: > > Jail# cat /etc/rc.conf > sshd_enable=3D"YES" > ifconfig_bce0=3D"inet x.y.z.60 netmask 255.255.255.192" > defaultrouter=3D"x.y.z.62" > hostname=3D"jail.example.com" That's not going to work, really (the ifconfig, defaultrouter, and unless you changed the defaults on the host system not even the hostname). You should actually remove those. > Host# cat /etc/rc.conf > sshd_enable=3D"NO" > ifconfig_bce0=3D"inet x.y.z.61 netmask 255.255.255.192" > defaultrouter=3D"x.y.z.62" > hostname=3D"host.example.com" > ipv6_enable=3D"NO" > jail_enable=3D"YES" > jail_set_hostname_allow=3D"NO" > jail_list=3D"jail" > jail_jail_hostname=3D"jail" > jail_jail_ip=3D"x.y.z.60" > jail_jail_rootdir=3D"my/jail/root" > jail_jail_devfs_enable=3D"YES" That doesn't really match your ifconfig output from above; something on the host system would have to set the IP address of the host. I would expect something like (you may have mixed jail and host addresses so properly sort this): # host system IP address ifconfig_bce0=3Dinet x.y.z.61 netmask 255.255.255.192" # jail IP address ifconfig_bce0_alias0=3Dinet x.y.z.60 netmask 255.255.255.255" Note that the alias has a /32 netmask. /bz --=20 Bjoern A. Zeeb It will not break if you know what you are doing. --0-1639566562-1258454454=:37440--