Date: Thu, 5 Jan 2017 10:56:15 -0800 (PST) From: Robroy Gregg <robroy@robroygregg.com> To: Ernie Luzar <luzar722@gmail.com> Cc: "freebsd-questions@freebsd.org" <freebsd-questions@freebsd.org> Subject: Re: jails & network/firewall setup Message-ID: <alpine.BSF.2.20.1701051030490.13234@beak.h.net> In-Reply-To: <586DD349.8000703@gmail.com> References: <586DD349.8000703@gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Good day Ernie, On Thu, 5 Jan 2017, Ernie Luzar wrote: > Finally got myself a static IP address added to the dynamic IP address > already assigned by my ISP. Both have their own unique domain names pointing > to them and going to the same MAC address modem. Yes I run ddclient to insure > the dynamic IP address and it's domain name are keep in sync. When I do a > ifconfig command I see the NIC facing the public internet has those 2 IP > address listed. > > If I assign the static IP address to a jail, will all traffic travailing on > that IP address be seen only by that jail without any firewall NAT forwarding > rules being used? Yes, packets destined for the jail your static IP's assigned to should reach jailed processes without requiring NAT. You probably already know about this point, yet regarding whether traffic will be seen only by the jail or not--though you won't need NAT, it'll still be necessary for you to configure daemons on your host system to associate only with your dynamic IP; otherwise, they may also associate with your static IP, which will make a confusing and/or insecure mixture of jailed and base processes available on the static IP. For instance, both OpenSSH and the NFS server associate themselves with all IPs on the computer, by default (and this would include your jail's static IP, despite these processes running in the host system, and not in the jail). And I don't know of any slick way to configure daemons in general to associate with a specific, yet dynamically assigned IP (but maybe you do). > IE: assuming there are no firewall rules blocking traffic on that IP > address. > > Lets state it a different way. Does all traffic targeted for a jail need to > have firewall NAT rules by IP address and port number to forward just the > desired port number traffic to that jail? No, if I've understood your networking configuration correctly, you won't need NAT. If your jail were assigned only an internal, private IP address, then getting traffic destined for your public, static IP to the jail and back would require NAT. Happiness to you Ernie, Robroy
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?alpine.BSF.2.20.1701051030490.13234>