On 8 Aug 2016, at 8:19, Niklaas Baudet von Gersdorff wrote:

Ernie Luzar [2016-08-07 13:20 -0400] :

Aha. So once I assigned those traffic from/to jails should go
through lo1 solely?

YES.

Thank you for clarifying that and your help. So, I attached
additional IP addresses on the jail host side accordingly:
My issue can be reduced to the question: When using jails, to
secure network traffic as best as I can, do I have to enable the
firewall on lo0 or is enabling it on the interface they are
attached to (in my case lo1) enough?

And: What do I need to do to restrict jails from using lo0?

The problem I think is that the routes (see one of your earlier emails) for the jail loopback IP addresses are pointing to lo0 and not lo1.

If you’d manually issue a

route change -host -inet6  fd16:dcc0:f4cc:3::2:1 -iface lo1


Hmm probably not…


root@rabbit4:~ # ifconfig lo1 create
lo1: bpf attached
root@rabbit4:~ # ifconfig lo1 inet6  fd16:dcc0:f4cc:3::2:1/128 alias
root@rabbit4:~ # route get -inet6  fd16:dcc0:f4cc:3::2:1
   route to: fd16:dcc0:f4cc:3::2:1
destination: fd16:dcc0:f4cc:3::2:1
        fib: 0
  interface: lo0
      flags: <UP,HOST,DONE,STATIC>
 recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
       0         0         0         0     16384         1         0
root@rabbit4:~ # route change -host -inet6 fd16:dcc0:f4cc:3::2:1 -iface lo1
change host fd16:dcc0:f4cc:3::2:1: gateway lo1 fib 0
root@rabbit4:~ # route get -inet6 fd16:dcc0:f4cc:3::2:1
   route to: fd16:dcc0:f4cc:3::2:1
destination: fd16:dcc0:f4cc:3::2:1
        fib: 0
  interface: lo0
      flags: <UP,HOST,DONE,STATIC>
 recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
       0         0         0         0     16384         1         0


Still points to lo0. That is interesting. I think at this point you have to assume packets go over lo0 and firewall there.

I wonder if this is a bug or a feature …

/bz
_______________________________________________
freebsd-pf@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "freebsd-pf-unsubscr...@freebsd.org"

Reply via email to