Date: Sat, 12 Sep 2015 12:24:05 -0600 (MDT) From: Warren Block <wblock@wonkity.com> To: Cary <lists@flederma.us> Cc: freebsd-questions@freebsd.org Subject: Re: dhclient(8) sets wrong interface netmask on boot up Message-ID: <alpine.BSF.2.20.1509121206480.58106@wonkity.com> In-Reply-To: <55F46514.9020702@flederma.us> References: <55F398CA.7050308@flederma.us> <CA%2BtpaK2A4kDVo8Ncgqz1FLAWkv83Aey-ay=ci52rbRZu7c3soA@mail.gmail.com> <55F46514.9020702@flederma.us>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 12 Sep 2015, Cary wrote:
> On 09/12/2015 10:45, Adam Vande More wrote:
>>>
>>> [/etc/rc.conf]
>>> hostname="public.fbsd.local"
>>> ifconfig_em0="DHCP"
>>> cloned_interfaces="${cloned_interfaces} lo1"
>>>
>>
>> previous line doesn't make much sense.
>>
>
> That was copied from the FreeBSD handbook section on managing jails
> (https://www.freebsd.org/doc/handbook/jails-ezjail.html). I didn't think
> that the jails would mess with the base host network configuration.
Well, they add aliases. The cloned_interfaces line lets the jails use a
separate loopback interface from the host.
> However, after re-looking at the jail config, I changed the config line
> in /usr/local/etc/ezjail/www_local from:
>
> export jail_www_local_ip="lo1|127.0.1.1,em0|192.168.20.166"
> to
> export jail_www_local_ip="lo1|127.0.1.1"
Wait, you were assigning the host's IP address to the jail? That's the
problem.
> After reboot, I was able to SSH into it without trouble. But now the
> httpd server cannot bind to the em0 interface. I guess I can forward
> traffic with ipfw or pfctl to get around that issue.
>
> LESSON LEARNED: ezjail *will* override the DHCP-assigned configuration
> of an interface!
Well... when the jail is reusing the host's IP address, yes. Jails use
aliases, and the netmask for an alias is 0xffffffff (255.255.255.255).
So the host got an IP address and valid netmask from the DHCP server at
boot, then the jail startup reassigned the same IP address to the host
as an alias, setting an alias netmask. From earlier posts:
>> < inet 192.168.20.166 netmask 0xffffffff broadcast 192.168.20.166
>> ---
>>> inet 192.168.20.166 netmask 0xffffff00 broadcast 192.168.20.255
It's a little surprising that didn't fail with an error.
The current setup (not specifying an IP address for the jail) ends up
using the host's IP address again. That also seems like a mistake, but
maybe not.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?alpine.BSF.2.20.1509121206480.58106>