Date: Fri, 23 Mar 2018 16:53:28 +0100 From: Joerg Surmann <joerg_surmann@elektropost.org> To: Miroslav Lachman <000.fbsd@quip.cz>, freebsd-current@freebsd.org Subject: Re: two NIC's in a jail Message-ID: <19503390-6434-e7cf-f5ce-d0170afc9f91@elektropost.org> In-Reply-To: <31fe7e04-4373-2454-aff5-0bd74b3f4b4e@quip.cz> References: <63ecbccc-48e2-4c67-fbf5-0a73094f29be@elektropost.org> <31fe7e04-4373-2454-aff5-0bd74b3f4b4e@quip.cz>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--Hqna5AstfTS2BWBKJp35swR5ANdBZUdoB
Content-Type: multipart/mixed; boundary="aLl1wpDFygpiy5YthSu6RaP8cxP79lqxd";
protected-headers="v1"
From: Joerg Surmann <joerg_surmann@elektropost.org>
To: Miroslav Lachman <000.fbsd@quip.cz>, freebsd-current@freebsd.org
Message-ID: <19503390-6434-e7cf-f5ce-d0170afc9f91@elektropost.org>
Subject: Re: two NIC's in a jail
References: <63ecbccc-48e2-4c67-fbf5-0a73094f29be@elektropost.org>
<31fe7e04-4373-2454-aff5-0bd74b3f4b4e@quip.cz>
In-Reply-To: <31fe7e04-4373-2454-aff5-0bd74b3f4b4e@quip.cz>
--aLl1wpDFygpiy5YthSu6RaP8cxP79lqxd
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Language: de-DE
Thanks for replay.
netstat -an | egrep 'tcp4.*80 .*LISTEN'
say:
netstat: kvm not available: /dev/mem No such file or directory <- is
inside a jail.
tcp4=C2=A0=C2=A0=C2=A0 0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 0 *.80=C2=A0=
=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 *.*=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =
LISTEN
grep -i Listen /usr/local/etc/apache24/httpd.conf
Listen 80
Listen 443
=46rom the internal IP is no Problem.
You are right. I'm not sure on wich IP's Apache is listening.
I have change the Listen directive to the external IP in httpd.conf
Listen 213.70.80.92:80
netstat -an | egrep 'tcp4.*80 .*LISTEN'
now say:
tcp4=C2=A0=C2=A0=C2=A0 0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 0=C2=A0 213=
=2E70.80.92:80=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 *.*=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 LISTEN
But apache is not availble from Internet.
=46rom Intranet... no Problem.
When i use tcpdump on Host i can see Traffic.
Whats wrong?
Am 23.03.2018 um 16:07 schrieb Miroslav Lachman:
> Joerg Surmann wrote on 2018/03/23 13:49:
>> Hi all,
>>
>> I have a Problem to understund how to manage 2 Networks inside a Jail.=
>>
>> i have create a jail (using ezjail) with a alias IP.
>> in rc.conf (on Host):
>>
>> ifconfig_vmx0=3D"inet 192.168.100.1 netmask 255.255.255.0"
>> ifconfig_vmx0_alias0=3D"inet 192.168.100.2 netmask 255.255.255.0"=C2=A0=
<- this
>> is the jail ip
>>
>> Inside the jail running apachhe24.
>>
>> Now i add a new NIC to the System.
>> in rc.conf (on Host):
>> ifconfig_em0=3D"inet 213.70.80.92 netmask 255.255.255.0"
>>
>> in /usr/local/etc/ezjail/myjail.conf:
>> i add the new ip
>> export jail_myjail_ip=3D"192.168.100.2,213.70.80.92"
>>
>> Restart the jail and ifconfig looks fine.
>> vmx0 -> inet 192.168.100.2
>> em0=C2=A0 -> inet 213.70.80.92
>>
>> Apache Listen on all NIC's (<VirtualHost *:80>)
>> But i can see my Website only via 192.168.100.2 from intern Network.
>>
>> The Host is behind a Firewall.
>> The IP=C2=A0 213.70.80.92 is enabled for incomming Traffic.
>>
>> When i give the Hostname in a Browser i become "connection Timeout".
>>
>> What is to do that the Host is accessable from Inet?
>
> Are you sure Apache is listening on both IPs?
>
> What netstat says?
>
> # netstat -an | egrep 'tcp4.*80 .*LISTEN'
>
> Also check what you have in httpd.conf for Listen directive
>
> # grep -i Listen /usr/local/etc/apache24/httpd.conf
>
> I am not using ezjail, I am using jail.conf
>
> costa {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 host.hostname=C2=A0=C2=A0 =3D=
"costa.example.com";
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ip4.addr=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 =3D AA.BB.CCC.DDD;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ip4.addr=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0 +=3D 192.168.222.57;
> }
>
> Real IP was replaced with AA.BB.CCC.DDD
>
> And it works. Services inside jail must be listening on both IPs or
> wildcard * (0.0.0.0)
>
> And be sure to disable hosts services to listen on IPs and ports you
> want to be served from jail.
>
> Miroslav Lachman
--aLl1wpDFygpiy5YthSu6RaP8cxP79lqxd--
--Hqna5AstfTS2BWBKJp35swR5ANdBZUdoB
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEKgIE1afOeXZNzpBEGHz25TAa4ssFAlq1IvgACgkQGHz25TAa
4suQPhAAyO26l+KjQ2BZzmcE8envE3aWvl67nmjJ+d2Gum8D7JA9WlrnQc69gL1y
KUrY8PgWjZQty37njONp+EhgRAwGQxrv28HFXmwEUbSp69SHYrV4k78Y1uBvo3Mw
+OhfaRGNSFK6tKbuxIaZ9I99i7yzZzZhVU0WmyA0H+DoHcoq+9NPDqj6cOzhEhrH
YOiv7MYqP62T3bpay7FmXMyH+kjtie+HDuhhiCDAbTLvlvUQdNn5VXBGHwfGa2RI
jQzL5GJ1g1aoCCRkxC99OmKEyetv6omQaZlbB8/a324OF6j8tIRJXHfwdJDF3c38
xKTagm5LbMzJvFuaCGT8CW7aGx4ImIfzLg0o6GbKg89cDpAQwb5ap1UYQYS0nfpo
OC7cluy1I4z5Qsl8pUwg6SytjqM1Z2JVfCcIg78yzy1cGI7TPZUWFiB9XwteYbZZ
N12/MYBqeay1dNYeZXZJZbnKwxizAWIHpFdMVvw3+vRnE2rZ8PRCRMtpr+quP+zG
VYwMteG3EuBYu+Y0rFR2pHVhuf5DJ9tjZIIDvrBvK9z9GdrZkvA45Zvh7W/E8zXp
8uvXvFzpV3ZFlihm7JOEjDdg+IvzPLcjHdLF3b0ED8XXS0fELpDLVq5ETbLo03AD
BpKJXOF+rIdvN/j2FyKgM4egjcti724PloSJCpgrqY1sQxMWJL8=
=si/n
-----END PGP SIGNATURE-----
--Hqna5AstfTS2BWBKJp35swR5ANdBZUdoB--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19503390-6434-e7cf-f5ce-d0170afc9f91>