2

I use FreeBSD 9.1 64-bit from the list here.

On my freebsd amazon instance, I have a jail running :

# jls
 JID  IP Address      Hostname                      Path
 1  192.168.1.101   01.gideon.com                /jails/01.gideon.com

If I goto that jails console I can't install perl on it. (If I do portsnap fetch inside the jail I get : host: isc_socket_bind: address not available and then it says no mirrors, giving up.)

I've looked at several articles and posts but I'm confused about what goes where, I just want you to tell me where I should put the right entries, this is a sample from this article, my system info is below:

rc.conf
hostname="" #what goes here?
defaultrouter=""#what goes here?
#I don't understand what this is for?
ifconfig_em0="inet 192.168.0.10 netmask 255.255.255.0"

#I'm guessing this should be like this:
ifconfig_xn0="inet 192.168.1.101 netmask 255.255.255.0"

# Should I use an alias?
# ifconfig_em0_alias0="inet 192.168.0.111 netmask 255.255.255.0"

This is what ifconfig -a gives me:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
        inet 127.0.0.1 netmask 0xff000000
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
xn0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=503<RXCSUM,TXCSUM,TSO4,LRO>
        ether 12:31:39:2a:dc:cc
        inet 10.8.106.58 netmask 0xfffffe00 broadcast 10.8.107.255
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet manual
        status: active

This is my /etc/resolve.conf:

# Generated by resolvconf
search ec2.internal
nameserver 172.16.0.23

So how do I go about this?

2 Answers 2

1

Modification of networking inside FreeBSD jail isn't allowed. A jail can use all host addresses, a few ones (restricted set, configured during a jail creating) or no networking at all. And, as far as I see, allowed IPs are automatically placed on interfaces seen inside the jail.

You should specify exact FreeBSD version for updates of the question, because jail behavior is being advanced with each release and details can be subtly different.

4
  • Hey thanks for your reply. updated my Question, I use freebsd9.1. I can't seem to access the network from my jail. I did have a problem doing cd /usr/src; make buildworld. I found this article on updating /usr/src but it seems the whole cvs this it outdated.
    – gideon
    Feb 23, 2013 at 12:03
  • I posted the buildworld problem here. unix.stackexchange.com/questions/65862/… Maybe that is what is causing this problem?
    – gideon
    Feb 23, 2013 at 12:10
  • Of course, correct world remake and following boot are proof that the system is up to some date, but they are only prerequisite and not a warranty for correct usage. If the issue persists after remake, you should recheck what are you doing. I've tested creating a jail on 9.1 and it's exactly how I described - one see only limited IP set inside the jail, but automatically assigned without a need to configure it again from inside the jail.
    – Netch
    Feb 27, 2013 at 7:29
  • Also I'm wondering what you try to do with network setup on EC2 guest system. As far as I see from their usage, you can't simply assign an arbitrary IP to interface, because you shall use the addresses offered by the cloud provider. As the result, you will have 1) 127.0.0.1, 2) an IP which maps to external world (via transparent NAT) and 3) optionally, IP of an internal network. That's all and all other IPs won't be visible from outside even if you assign them to an interface. So all these plays with your IPs will fail. Why do you need jails instead of EC2 micro instances?
    – Netch
    Feb 27, 2013 at 7:33
0

The accepted answer is correct. Modification of network from inside of a jailed environment is not allowed. It defeats the purpose of jail.

However, the solution to the original problem is to configure jail host. You need to configure firewall with NAT enabled on the jail host. Firewall shall allow outbound traffic from jailed IP address.

EC2 firewall does not restrict FreeBSD jails as I was able to get it working of FreeBSD 10.2-RELEASE. That's another statement that may be misleading in the accepted answer. Host creates its own private (NATed) IP address. EC2 seems to not restrict us from doing so at hardware level, but it can potentially restrict traffic at firewall level.

As to why would we do that? There is advantage in utilizing all available resources of a single instance plus added security if done right.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .