1

I am trying to connect a jail to the internet in a aws ec2 instance. I am able to create the jail and execute a console inside, the problem is that the jail does not have any connection to the outside.

This are the steps to create the jail:

echo 'cloned_interfaces="lo1"' >> /etc/rc.conf
service netif cloneup
ezjail-admin create jail 'lo1|127.0.1.1,xn0|172.31.36.57'
cp /etc/resolv.conf /usr/jails/jail/etc
ezjail-admin console -f jail

After that if I try any installation using pkg:

The package management tool is not yet installed on your system.
Do you want to fetch and install it now? [y/N]: y
Bootstrapping pkg from pkg+http://pkg.FreeBSD.org/FreeBSD:12:amd64/quarterly, please wait...
pkg: Error fetching http://pkg.FreeBSD.org/FreeBSD:12:amd64/quarterly/Latest/pkg.txz: No address record
Address resolution failed for http://pkg.FreeBSD.org/FreeBSD:12:amd64/quarterly.
Consider changing PACKAGESITE.

See output of the host ifconfig:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
    options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
    inet6 ::1 prefixlen 128
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
    inet 127.0.0.1 netmask 0xff000000
    groups: lo
    nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
xn0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 9001
    options=503<RXCSUM,TXCSUM,TSO4,LRO>
    ether 06:26:aa:da:23:d2
    inet6 fe80::426:aaff:feda:23d2%xn0 prefixlen 64 scopeid 0x2
    inet 172.31.36.56 netmask 0xfffff000 broadcast 172.31.47.255
    inet 172.31.36.57 netmask 0xffffffff broadcast 172.31.36.57
    media: Ethernet manual
    status: active
    nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
lo1: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
    options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
    inet6 fe80::1%lo1 prefixlen 64 scopeid 0x3
    inet 127.0.1.1 netmask 0xffffffff
    groups: lo
    nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

I think the second IP i give to the interface is not valid.

Do you know what would be the way to get connectivity from the jail?

Improve this question
1
  • Figure out how you want to route first. lo1 with 127.0.1.1 is internal - so you would typically use pf to NAT traffic to the jail. The 2nd IP address confuses me. Maybe what you are looking for is ip4=inherit. Figure out addressing. Read Chapter 15 and maybe my previous jails answer. Then update Q.
    – Claus Andersen
    Commented May 13, 2021 at 18:32

1 Answer 1

Reset to default
0

Got the connectivity working using pf

ext_if="xn0"
jail_net="127.0.1.1"
nat pass on $ext_if from $jail_net to any -> $ext_if
pass out
pass in
Improve this answer
3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .