0

I am trying to connect a jail to the internet in a aws ec2 instance. I am able to create the jail and execute a console inside, the problem is that the jail does not have any connection to the outside.

This are the steps to create the jail:

echo 'cloned_interfaces="lo1"' >> /etc/rc.conf
service netif cloneup
ezjail-admin create jail 'lo1|127.0.1.1,xn0|172.31.36.57'
cp /etc/resolv.conf /usr/jails/jail/etc
ezjail-admin console -f jail

After that if I try any installation using pkg:

The package management tool is not yet installed on your system.
Do you want to fetch and install it now? [y/N]: y
Bootstrapping pkg from pkg+http://pkg.FreeBSD.org/FreeBSD:12:amd64/quarterly, please wait...
pkg: Error fetching http://pkg.FreeBSD.org/FreeBSD:12:amd64/quarterly/Latest/pkg.txz: No address record
Address resolution failed for http://pkg.FreeBSD.org/FreeBSD:12:amd64/quarterly.
Consider changing PACKAGESITE.

See output of the host ifconfig:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
    options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
    inet6 ::1 prefixlen 128
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
    inet 127.0.0.1 netmask 0xff000000
    groups: lo
    nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
xn0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 9001
    options=503<RXCSUM,TXCSUM,TSO4,LRO>
    ether 06:26:aa:da:23:d2
    inet6 fe80::426:aaff:feda:23d2%xn0 prefixlen 64 scopeid 0x2
    inet 172.31.36.56 netmask 0xfffff000 broadcast 172.31.47.255
    inet 172.31.36.57 netmask 0xffffffff broadcast 172.31.36.57
    media: Ethernet manual
    status: active
    nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
lo1: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
    options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
    inet6 fe80::1%lo1 prefixlen 64 scopeid 0x3
    inet 127.0.1.1 netmask 0xffffffff
    groups: lo
    nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

I think the second IP i give to the interface is not valid.

Do you know what would be the way to get connectivity from the jail?

1
  • Figure out how you want to route first. lo1 with 127.0.1.1 is internal - so you would typically use pf to NAT traffic to the jail. The 2nd IP address confuses me. Maybe what you are looking for is ip4=inherit. Figure out addressing. Read Chapter 15 and maybe my previous jails answer. Then update Q. May 13, 2021 at 18:32

1 Answer 1

0

Got the connectivity working using pf

ext_if="xn0"
jail_net="127.0.1.1"
nat pass on $ext_if from $jail_net to any -> $ext_if
pass out
pass in
3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.