Hi,
I'm new to FreeBSD (only started tinkering about with it last week), and after lots of digging through the documentation, handbook, and many other online resources I managed to have my vnet(9) enabled jail(8) working in conjunction with ipfw(8) in-kernel NAT. Both inbound and outbound traffic was working properly within the jail on FreeBSD 12.2-RELEASE-p7.
After upgrading to FreeBSD 13.0-RELEASE-p3 - without touching anything else - outbound traffic from the jail stopped working. Inbound traffic is still working fine. I read through the release notes for 13.0-RELEASE to see if there are any relevant backward incompatible changes listed and figured that the routing stack rewrite may have something to do with it, although I can't seem to figure out how it is affecting my NAT setup.
This is a VirtualBox VM running on a Windows 10 host.
/etc/ipfw.rules
/etc/jail.conf
/etc/rc.conf
What am I missing here?
Thanks in advance!
I'm new to FreeBSD (only started tinkering about with it last week), and after lots of digging through the documentation, handbook, and many other online resources I managed to have my vnet(9) enabled jail(8) working in conjunction with ipfw(8) in-kernel NAT. Both inbound and outbound traffic was working properly within the jail on FreeBSD 12.2-RELEASE-p7.
After upgrading to FreeBSD 13.0-RELEASE-p3 - without touching anything else - outbound traffic from the jail stopped working. Inbound traffic is still working fine. I read through the release notes for 13.0-RELEASE to see if there are any relevant backward incompatible changes listed and figured that the routing stack rewrite may have something to do with it, although I can't seem to figure out how it is affecting my NAT setup.
This is a VirtualBox VM running on a Windows 10 host.
/etc/ipfw.rules
Code:
#!/bin/sh
cmd="ipfw -q add"
skip="skipto 1000"
pif=em0
ks="keep-state"
# Delete all rules
ipfw -q -f flush
# Disable one_pass and setup NAT with port forwarding
ipfw disable one_pass
ipfw -q nat 1 config if $pif same_ports unreg_only reset \
redirect_port tcp 10.0.0.10:80 80
$cmd 010 allow all from any to any via lo0
$cmd 099 reass all from any to any in
# Inbound NAT
$cmd 100 nat 1 ip from any to any in via $pif
# Statefull firewall
$cmd 101 check-state
# SSH
$cmd 110 allow tcp from any to me ssh setup $ks
# ICMP
$cmd 111 allow icmp from any to any
# Outbound NAT
$cmd 112 $skip tcp from any to any out via $pif setup $ks
$cmd 113 $skip ip from any to any out via $pif $ks
$cmd 999 deny log all from any to any
$cmd 1000 nat 1 ip from any to any out via $pif
$cmd 1001 allow ip from any to any
# Deny the rest
$cmd 65500 deny ip from any to any/etc/jail.conf
Code:
# Global settings applied to all jails.
path = "/zroot/jails/$name";
devfs_ruleset = 4;
# VNET & Bridge
exec.clean;
vnet;
vnet.interface = "epair${epair}b";
exec.prestart = "ifconfig bridge0 > /dev/null 2> /dev/null || ( ifconfig bridge0 create && ifconfig bridge0 addm em0 && ifconfig bridge0 up )";
exec.prestart += "ifconfig epair${epair} create up";
exec.prestart += "ifconfig bridge0 addm epair${epair}a";
# Standard recipe
exec.start = "/bin/sh /etc/rc";
exec.start += "ifconfig epair${epair}b inet ${ipv4}";
exec.start += "route add default ${gw4}";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.poststop = "ifconfig bridge0 deletem epair${epair}a";
exec.poststop += "ifconfig epair${epair}a destroy";
exec.consolelog = "/var/log/jail_${name}_console.log";
mount.devfs;
# Per-jail settings
nginx {
host.hostname = "nginx";
$ipv4 = "10.0.0.10/24";
$gw4 = "10.0.0.1";
$epair = "0";
}/etc/rc.conf
Code:
clear_tmp_enable="YES"
syslogd_flags="-ss"
sendmail_enable="NONE"
hostname="freebsd.lan"
ifconfig_em0="DHCP"
ifconfig_em0_ipv6="inet6 accept_rtadv"
sshd_enable="YES"
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="AUTO"
zfs_enable="YES"
jail_enable="YES"
gateway_enable="YES"
firewall_enable="YES"
firewall_script="/etc/ipfw.rules"
firewall_nat_enable="YES" ifconfig
Code:
em0: flags=8963<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=4810099<RXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,VLAN_HWFILTER,NOMAP>
ether 08:00:27:9f:6c:2f
inet6 fe80::a00:27ff:fe9f:6c2f%em0 prefixlen 64 scopeid 0x1
inet6 fd57:ff64:a85a:0:a00:27ff:fe9f:6c2f prefixlen 64 autoconf
inet 10.0.0.225 netmask 0xffffff00 broadcast 10.0.0.255
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
inet 127.0.0.1 netmask 0xff000000
groups: lo
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
ether 58:9c:fc:10:ff:b9
id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
member: epair0a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 4 priority 128 path cost 2000
member: em0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 1 priority 128 path cost 20000
groups: bridge
nd6 options=9<PERFORMNUD,IFDISABLED>
epair0a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 02:3a:96:e3:ce:0a
groups: epair
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>What am I missing here?
Thanks in advance!
