Date: Tue, 08 Jul 2008 17:35:09 +0100 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: David Allen <the.real.david.allen@gmail.com> Cc: Mel <fbsd.questions@rachie.is-a-geek.net>, freebsd-questions@freebsd.org Subject: Re: Jails and IP Aliasing Message-ID: <4873973D.1080402@infracaninophile.co.uk> In-Reply-To: <2daa8b4e0807080903o609d6b7ag831845b7939c20c8@mail.gmail.com> References: <2daa8b4e0807070951u607ff031v98b5b96103fdab4@mail.gmail.com> <200807081124.33377.fbsd.questions@rachie.is-a-geek.net> <2daa8b4e0807080903o609d6b7ag831845b7939c20c8@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig3FBED74684C6CAB552A53A4E
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: quoted-printable
David Allen wrote:
=20
> There was a post recently (Matthew Seaman's name comes to mind) that
> suggested binding jails to addresses in the loopback range and then
> using firewall rules to redirect the traffic accordingly. There's a
> possibility that may help in this case, but that layer of added
> complexity isn't much of an improvement over seeing connections with
> seemingly identical endpoints and interpreting the results in my head.
Guilty as charged M'lud.
However what I recommended was a more-than-slightly hacky way to achieve =
three things:
* Something like a loopback address inside the jail. It may be
127.0.0.2 instead of 127.0.0.1 but most software can be persuaded
to use it for loopback style things.
* The ability to map several IPs onto the jailed system by use of
NAT and redirect within firewall rules
* The ability to have a jail with /no/ external IP for when the
paranoia becomes unbearable[*].
Of course, all this will be immediately obsoleted by Marco Zec's work
on virtualizing the IP stack. http://imunes.tel.fer.hr/virtnet/
Cheers,
Matthew
[*] Combine this with a Hardware Load Balancer that does Direct Server
Return and you can have a publicly accessible jailed server with /no=20
external IP address/. =20
--=20
Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
Kent, CT11 9PW
--------------enig3FBED74684C6CAB552A53A4E
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (FreeBSD)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEAREIAAYFAkhzl0sACgkQ8Mjk52CukIzOTACfe0zbJM6KknOBX/WX9UNfDzaY
7d8AnRPc0t/P5dtBYW8no77N/cdXbMFR
=duXo
-----END PGP SIGNATURE-----
--------------enig3FBED74684C6CAB552A53A4E--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4873973D.1080402>