I am trying to connect a jail to the internet in a aws ec2 instance. I am able to create the jail and execute a console inside, the problem is that the jail does not have any connection to the outside.

This are the steps to create the jail:

echo 'cloned_interfaces="lo1"' >> /etc/rc.conf
service netif cloneup
ezjail-admin create jail 'lo1|,xn0|'
cp /etc/resolv.conf /usr/jails/jail/etc
ezjail-admin console -f jail

After that if I try any installation using pkg:

The package management tool is not yet installed on your system.
Do you want to fetch and install it now? [y/N]: y
Bootstrapping pkg from pkg+http://pkg.FreeBSD.org/FreeBSD:12:amd64/quarterly, please wait...
pkg: Error fetching http://pkg.FreeBSD.org/FreeBSD:12:amd64/quarterly/Latest/pkg.txz: No address record
Address resolution failed for http://pkg.FreeBSD.org/FreeBSD:12:amd64/quarterly.
Consider changing PACKAGESITE.

See output of the host ifconfig:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
    inet6 ::1 prefixlen 128
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
    inet netmask 0xff000000
    groups: lo
xn0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 9001
    ether 06:26:aa:da:23:d2
    inet6 fe80::426:aaff:feda:23d2%xn0 prefixlen 64 scopeid 0x2
    inet netmask 0xfffff000 broadcast
    inet netmask 0xffffffff broadcast
    media: Ethernet manual
    status: active
lo1: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
    inet6 fe80::1%lo1 prefixlen 64 scopeid 0x3
    inet netmask 0xffffffff
    groups: lo

I think the second IP i give to the interface is not valid.

Do you know what would be the way to get connectivity from the jail?

  • Figure out how you want to route first. lo1 with is internal - so you would typically use pf to NAT traffic to the jail. The 2nd IP address confuses me. Maybe what you are looking for is ip4=inherit. Figure out addressing. Read Chapter 15 and maybe my previous jails answer. Then update Q. May 13, 2021 at 18:32

1 Answer 1


Got the connectivity working using pf

nat pass on $ext_if from $jail_net to any -> $ext_if
pass out
pass in

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.