2

I am currently trying to set up a server on FreeBSD. I want to create jails with ezjails according to the handbook. I am following the example to install BIND inside a jail but I am stuck at the installation step (make -C /usr/ports/dns/bind99 install clean).

At first I thought I had a DNS problem (bad /etc/resolv.conf) but it seems that I have simply no internet inside the jail.

On the host: (8.8.178.110 is www.freebsd.org)

root@varda:~ # nc -z -w 2 8.8.178.110 80
Connection to 8.8.178.110 80 port [tcp/http] succeeded!

Inside the jail:

root@dns:~ # nc -z -w 2 8.8.178.110 80; echo $?
1

Any idea what is going on?


root@varda:~ # ezjail-admin list
STA JID  IP              Hostname                       Root Directory
--- ---- --------------- ------------------------------ ------------------------
DR  2    192.168.4.1     www                            /home/jails/www
    2    lo1|127.0.1.1
DR  3    192.168.3.1     dns                            /home/jails/dns
    3    lo2|127.0.2.1

(www is another jail in which I have the same problem)


root@varda:~ # ifconfig
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
    options=4219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC,VLAN_HWTSO>
    ether 00:22:4d:ad:be:2a
    inet ???.???.???.??? netmask 0xffffff00 broadcast ???.???.???.??? 
    inet6 fe80::222:4dff:fead:be2a%em0 prefixlen 64 scopeid 0x1 
    inet6 2001:41d0:a:f231::1 prefixlen 128 
    inet 192.168.4.1 netmask 0xffffffff broadcast 192.168.4.1 
    inet 192.168.3.1 netmask 0xffffffff broadcast 192.168.3.1 
    nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
media: Ethernet autoselect (100baseTX <full-duplex>)
    status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
    options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
    inet6 ::1 prefixlen 128 
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2 
    inet 127.0.0.1 netmask 0xff000000 
    nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
lo1: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
    options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
    inet 127.0.1.1 netmask 0xffffffff 
    nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
lo2: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
    options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
    inet 127.0.2.1 netmask 0xffffffff 
    nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>

root@dns:~ # ifconfig
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
 options=4219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC,VLAN_HWTSO>
    ether 00:22:4d:ad:be:2a
    inet 192.168.3.1 netmask 0xffffffff broadcast 192.168.3.1 
    media: Ethernet autoselect (100baseTX <full-duplex>)
    status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
    options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
lo1: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
    options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
lo2: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
    options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
    inet 127.0.2.1 netmask 0xffffffff
  • 2
    Nice question title :) – MatthewRock Sep 5 '15 at 10:51
  • for a moment, i thought prisoners are using stack exchange.... – Madhavan Sep 5 '15 at 14:35
  • I didn't get it at once… Anyways it is funny. But perhaps this is not the good forum to ask the question (only 44 questions tagged with "jails") – styko Sep 5 '15 at 15:51
  • 1
    Are these addresses accessible over the local network from a different machine? And since these addresses (192.168.x.x) are private networks I guess you are using a NAT to access the Internet. This probably means that you need to add the 192.168.3/24 and 192.168.4/24 to your NAT. – Raphael Ahrens Sep 9 '15 at 11:56
  • 1
    Do you have "pf" running? You need to have setup NAT rules and allow for DNS (and Internet traffic) in the firewall on the host to allow access from the jail. Maybe post your pf.conf – Claus Andersen Sep 11 '15 at 8:21
3

You need the resolv.conf in /path/to/jails/etc/resolv.conf

This is a complete list of what I actually put in jail before I start.

  • Thanks so much for this... I had carefully followed handbook, cloned loopback, setup nat, etc, but this was definitely the bit I was missing. Once I threw this on my jail, outbound networking worked like a charm. Cheers! – Christopher Kuttruff Jun 2 '18 at 21:45
  • @greg your github repo is gone, but for those wondering cp /etc/resolv.conf /usr/jails/myjail/etc/resolv.conf does it. I don't know what did the other tasks in @greg's ansible file did though. – springloaded Jul 2 '18 at 20:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.