On 8 Aug 2016, at 8:19, Niklaas Baudet von Gersdorff wrote:
Ernie Luzar [2016-08-07 13:20 -0400] :
Aha. So once I assigned those traffic from/to jails should go
through lo1 solely?
YES.
Thank you for clarifying that and your help. So, I attached
additional IP addresses on the jail host side accordingly:
…
My issue can be reduced to the question: When using jails, to
secure network traffic as best as I can, do I have to enable the
firewall on lo0 or is enabling it on the interface they are
attached to (in my case lo1) enough?
And: What do I need to do to restrict jails from using lo0?
The problem I think is that the routes (see one of your earlier emails)
for the jail loopback IP addresses are pointing to lo0 and not lo1.
If you’d manually issue a
route change -host -inet6 fd16:dcc0:f4cc:3::2:1 -iface lo1
Hmm probably not…
root@rabbit4:~ # ifconfig lo1 create
lo1: bpf attached
root@rabbit4:~ # ifconfig lo1 inet6 fd16:dcc0:f4cc:3::2:1/128 alias
root@rabbit4:~ # route get -inet6 fd16:dcc0:f4cc:3::2:1
route to: fd16:dcc0:f4cc:3::2:1
destination: fd16:dcc0:f4cc:3::2:1
fib: 0
interface: lo0
flags: <UP,HOST,DONE,STATIC>
recvpipe sendpipe ssthresh rtt,msec mtu weight expire
0 0 0 0 16384 1 0
root@rabbit4:~ # route change -host -inet6 fd16:dcc0:f4cc:3::2:1 -iface
lo1
change host fd16:dcc0:f4cc:3::2:1: gateway lo1 fib 0
root@rabbit4:~ # route get -inet6 fd16:dcc0:f4cc:3::2:1
route to: fd16:dcc0:f4cc:3::2:1
destination: fd16:dcc0:f4cc:3::2:1
fib: 0
interface: lo0
flags: <UP,HOST,DONE,STATIC>
recvpipe sendpipe ssthresh rtt,msec mtu weight expire
0 0 0 0 16384 1 0
Still points to lo0. That is interesting. I think at this point you
have to assume packets go over lo0 and firewall there.
I wonder if this is a bug or a feature …
/bz
_______________________________________________
freebsd-pf@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "freebsd-pf-unsubscr...@freebsd.org"
