I use FreeBSD 9.1 64-bit from the list here.

On my freebsd amazon instance, I have a jail running :

# jls
 JID  IP Address      Hostname                      Path
 1   01.gideon.com                /jails/01.gideon.com

If I goto that jails console I can't install perl on it. (If I do portsnap fetch inside the jail I get : host: isc_socket_bind: address not available and then it says no mirrors, giving up.)

I've looked at several articles and posts but I'm confused about what goes where, I just want you to tell me where I should put the right entries, this is a sample from this article, my system info is below:

hostname="" #what goes here?
defaultrouter=""#what goes here?
#I don't understand what this is for?
ifconfig_em0="inet netmask"

#I'm guessing this should be like this:
ifconfig_xn0="inet netmask"

# Should I use an alias?
# ifconfig_em0_alias0="inet netmask"

This is what ifconfig -a gives me:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
        inet netmask 0xff000000
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
xn0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 12:31:39:2a:dc:cc
        inet netmask 0xfffffe00 broadcast
        media: Ethernet manual
        status: active

This is my /etc/resolve.conf:

# Generated by resolvconf
search ec2.internal

So how do I go about this?


Modification of networking inside FreeBSD jail isn't allowed. A jail can use all host addresses, a few ones (restricted set, configured during a jail creating) or no networking at all. And, as far as I see, allowed IPs are automatically placed on interfaces seen inside the jail.

You should specify exact FreeBSD version for updates of the question, because jail behavior is being advanced with each release and details can be subtly different.

  • Hey thanks for your reply. updated my Question, I use freebsd9.1. I can't seem to access the network from my jail. I did have a problem doing cd /usr/src; make buildworld. I found this article on updating /usr/src but it seems the whole cvs this it outdated. – gideon Feb 23 '13 at 12:03
  • I posted the buildworld problem here. unix.stackexchange.com/questions/65862/… Maybe that is what is causing this problem? – gideon Feb 23 '13 at 12:10
  • Of course, correct world remake and following boot are proof that the system is up to some date, but they are only prerequisite and not a warranty for correct usage. If the issue persists after remake, you should recheck what are you doing. I've tested creating a jail on 9.1 and it's exactly how I described - one see only limited IP set inside the jail, but automatically assigned without a need to configure it again from inside the jail. – Netch Feb 27 '13 at 7:29
  • Also I'm wondering what you try to do with network setup on EC2 guest system. As far as I see from their usage, you can't simply assign an arbitrary IP to interface, because you shall use the addresses offered by the cloud provider. As the result, you will have 1), 2) an IP which maps to external world (via transparent NAT) and 3) optionally, IP of an internal network. That's all and all other IPs won't be visible from outside even if you assign them to an interface. So all these plays with your IPs will fail. Why do you need jails instead of EC2 micro instances? – Netch Feb 27 '13 at 7:33

The accepted answer is correct. Modification of network from inside of a jailed environment is not allowed. It defeats the purpose of jail.

However, the solution to the original problem is to configure jail host. You need to configure firewall with NAT enabled on the jail host. Firewall shall allow outbound traffic from jailed IP address.

EC2 firewall does not restrict FreeBSD jails as I was able to get it working of FreeBSD 10.2-RELEASE. That's another statement that may be misleading in the accepted answer. Host creates its own private (NATed) IP address. EC2 seems to not restrict us from doing so at hardware level, but it can potentially restrict traffic at firewall level.

As to why would we do that? There is advantage in utilizing all available resources of a single instance plus added security if done right.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.