From owner-freebsd-questions@FreeBSD.ORG Tue Aug 12 11:33:36 2014 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 0F4C9D41 for ; Tue, 12 Aug 2014 11:33:36 +0000 (UTC) Received: from mail-ob0-f172.google.com (mail-ob0-f172.google.com [209.85.214.172]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id CB7B22090 for ; Tue, 12 Aug 2014 11:33:35 +0000 (UTC) Received: by mail-ob0-f172.google.com with SMTP id wn1so7004310obc.3 for ; Tue, 12 Aug 2014 04:33:29 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=JqYXEFnLn+ZnMUOvbrFbtPF52bvfLzJkSxCgTMk+9BE=; b=LDsNKSZgEib5qBdm7JbqdpzEyalg8HvchFllihs4tTP0rbkwQtJkb/tN8nSstbk73K aC1OUpCBp/9BnbDam5Tkeh9vts4OsiWkAsVcV8VrlSZP0XYr9Gc0/2SfH7d/fgDWk9ph eTyc8Z+Ppdg2nnlBRtFrvyl1WNZkzzTjOH0KsGP/gA9kFq/2CFNZhGLWYQK7iUe9fLwY P9TAtqFPDjSscxJzqPK+Fz/1LmWyYn8mfw+NNMG1WXxBrHY0PshWYXhfJyma8XMvzIP1 BwmEqfpqOgB3OY4HBGdXUq2VOWLIxUARCqav4WzxdcCWdp+gK1eWNBm9HALKKZtfZGW1 WKvA== X-Gm-Message-State: ALoCoQmVVB1qwUvvkXLdLpxEeDtisKMB5i24yqWyCGRSoobucLVAnfFN7P96qtejuifQRYRlkuQb MIME-Version: 1.0 X-Received: by 10.60.57.193 with SMTP id k1mr3653424oeq.66.1407839458578; Tue, 12 Aug 2014 03:30:58 -0700 (PDT) Received: by 10.76.68.230 with HTTP; Tue, 12 Aug 2014 03:30:58 -0700 (PDT) In-Reply-To: <53E75F57.5040907@a1poweruser.com> References: <53E75F57.5040907@a1poweruser.com> Date: Tue, 12 Aug 2014 11:30:58 +0100 Message-ID: Subject: Re: correctly configuring PF with jailed environments From: Norman Khine To: Fbsd8 Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.18 Cc: freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Aug 2014 11:33:36 -0000 i am using nginx and here is the nginx.conf file https://gist.github.com/nkhine/f620f8bdc0fb613b7b59 i am sharing the node application static files using nullfs as: # cat etc/fstab.www /usr/jails/basejail /usr/jails/www/basejail nullfs ro 0 0 /usr/jails/app/home/app/node-blade-boiler-template/public /usr/jails/www/var/www nullfs ro 0 0 and then in my nginx.conf i have https://gist.github.com/nkhine/f620f8bdc0fb613b7b59#file-gistfile1-txt-L122 i have set /var/www as the root for static files. this works the strange thing is that if you click twice on a link it loads quickly, but if you click only one time, it just takes time for the page to load. so i think the issue is with nginx and the proxy On Sun, Aug 10, 2014 at 1:02 PM, Fbsd8 wrote: > Norman Khine wrote: > >> hello, i have a web application running 3 jail environments one for Nginx >> Web server, one for MongoDB/Redis and one for my Node.js application >> >> this is my current pf.conf file >> >> https://gist.github.com/nkhine/d03ea23a749c47bcc4d0 >> >> this works, as there is no access to my node app nor any of the dbs from >> public interfaces. >> >> the rules come out as >> >> # pfctl -s rules >> scrub out log on igb0 all random-id min-ttl 15 set-tos 0x1c fragment >> reassemble >> scrub in log on igb0 all min-ttl 15 fragment reassemble >> scrub in all fragment reassemble >> >> i find that on my webserver i get timeouts and the html application does >> not >> >> load up quickly! >> >> also, are there any improvements i can make to this as to ensure a more >> secure environment? >> >> any advice much appreciated >> >> > I do not see this as a jail or pf problem. > Look at commenting out any mod_* from the httpd.conf file that the html > application does not use. Check that the 3 apache jails are not using the > same service port (80). Do not use the apache default directory location > for holding your html application files. Disable the pf firewall in rc.conf > and test if this speeds up apache. > > > > > -- %>>> "".join( [ {'*':'@','^':'.'}.get(c,None) or chr(97+(ord(c)-83)%26) for c in ",adym,*)&uzq^zqf" ] )