I'm trying to set up an Ampache media server at home and am taking the opportunity to learn how to use jails on FreeBSD. I'm trying to set up jails on a separate loopback network on the host and use the NAT features of PF to direct the traffic where it should go. I've tried following multiple different guides for this, except everything I can find refers to using ezjail and I want to do it using just jail.conf and pf.conf, if possible.
The problem is that the jails cannot access the internet. I have set up their resolv.conf files and - I thought - set up the shared network and the NAT rules to make it work. Here's my current setup:
/etc/rc.conf
/etc/jail.conf
/etc/pf.conf
Running tcpdump on pflog0 shows nothing when I attempt to use the host's pkg to install packages in a jail. The host has internet access. The jails' rc.conf files only disable sendmail and prevents syslogd from communicating on the network. The jails properly receive their IP address and hang when they attempt to access the internet, followed eventually by "No address record" for requests with domain names or "Operation timed out" for requests using IP addresses.
I'm new to FreeBSD and PF, so I'm not sure where to go from here. It seems like PF is blocking part of the request, response, or both, but I'm not sure how to check that or how I would fix it. Any help is appreciated.
The problem is that the jails cannot access the internet. I have set up their resolv.conf files and - I thought - set up the shared network and the NAT rules to make it work. Here's my current setup:
/etc/rc.conf
Code:
clear_tmp_enable="YES"
syslogd_flags="-ss"
sendmail_enable="NONE"
hostname="faustus"
ifconfig_fxp0="DHCP"
ifconfig_fxp0_ipv6="inet6 accept_rtadv"
sshd_enable="YES"
ntpdate_enable="YES"
powerd_enable="YES"
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="AUTO"
kld_list="/boot/kernel/i915kms.ko"
cloned_interfaces="lo1"
#ifconfig_lo1="inet 10.0.1.1/24 netmask 255.255.255.0"
ipv4_addrs_lo1="10.0.1.1/24 10.0.1.2/24 10.0.1.3/24"
# Enabled packet forwarding between interfaces
gateway_enable="YES"
blacklistd_enable="YES"
jail_enable="YES"
pf_enable="YES"
pflog_enable="YES"
pflog_logfile="/var/log/pflog"/etc/jail.conf
Code:
mount.devfs;
path="/usr/jails/$name";
host.hostname="$name.localdomain";
exec.clean;
exec.start="sh /etc/rc";
exec.stop="sh /etc/rc.shutdown";
exec.consolelog="/usr/jails/$name/var/log/jail.log";
interface="lo1";
nginx {
ip4.addr="lo1|10.0.1.2";
}
ampache {
ip4.addr="lo1|10.0.1.3";
}/etc/pf.conf
Code:
ext_if="fxp0"
ext_net=$ext_if:network
jail_if="lo1"
jail_net=$jail_if:network
nginx_ports="{ http, https }"
nginx_ip="10.0.1.2"
# Don't filter loopback
set skip on lo0
set loginterface lo1
set block-policy return
set fail-policy return
# Sanitize incoming data
scrub in on $ext_if all
# Route HTTP/S to nginx jail
#nat pass on $ext_if inet from $jail_net to any -> ($ext_if)
nat on $ext_if from $jail_net to any -> ($ext_if)
rdr on $ext_if proto tcp from any to ($ext_if) port $nginx_ports -> $nginx_ip
# Allow blacklistd to block stuff
#anchor "blacklistd/*" in on $ext_if
# Block incoming by default
#block in
# Allow outgoing by default
pass out
pass in
# Prevent spoofing attacks
#antispoof for $ext_if
# Allow traffic to/from jails
#pass in on $ext_if proto tcp from $ext_net to $jail_net port $nginx_ports keep state
#pass out on $jail_if proto tcp from $ext_net to $jail_net port $nginx_ports keep state
# Allow SSH
#pass in on $ext_if proto tcp from any to ($ext_if) port ssh
# Allow ICMP
#pass inet proto icmp from $jail_net to any keep state
pass in on $ext_if inet proto icmp to ($ext_if) icmp-type { unreach, redir, timex, echoreq }
pass in on $jail_if inet proto icmp to ($jail_if) icmp-type { unreach, redir, timex, echoreq }Running tcpdump on pflog0 shows nothing when I attempt to use the host's pkg to install packages in a jail. The host has internet access. The jails' rc.conf files only disable sendmail and prevents syslogd from communicating on the network. The jails properly receive their IP address and hang when they attempt to access the internet, followed eventually by "No address record" for requests with domain names or "Operation timed out" for requests using IP addresses.
I'm new to FreeBSD and PF, so I'm not sure where to go from here. It seems like PF is blocking part of the request, response, or both, but I'm not sure how to check that or how I would fix it. Any help is appreciated.
