Re: Filtering outbound traffic for private address jails?

2016-06-26 Thread org.freebsd.security
'Lo. On 2016-06-26T02:32:04 + James Lodge wrote: > > If you clone lo1, give it a 192.168.x.x/32 IP and then use the following > pf.conf > Do you need to bridge the interfaces? You may need to add > gateway_enable="YES" to rc.conf > > Not sure if that's what you're trying to do? > > James

Re: Filtering outbound traffic for private address jails?

2016-06-26 Thread org.freebsd.security
Hello. On 2016-06-25T17:17:53 -0600 Alan Somers wrote: > > I'm filtering outbound traffic, but I'm not using NAT on the jail > host. Instead, I have a dedicated router doing NAT, and my jail host > has multiple IP addresses. At first I tried using traditional > shared-address jails, but the fi

Re: ifconfig: BRDGADD lo1: invalid argument

2016-06-26 Thread org.freebsd.security
Hello. On 2016-06-25T18:13:18 -0600 Alan Somers wrote: > On Sat, Jun 25, 2016 at 4:05 PM, wrote: > > I'm not using vnet jails. I'm actually just trying to get filtering of > > outbound traffic (see the other mail I sent to this list a few seconds > > before you responded). > > Based on my e

Re: ifconfig: BRDGADD lo1: invalid argument

2016-06-25 Thread org.freebsd.security
Hello! On 2016-06-25T23:46:36 +0200 Marko Zec wrote: > > if_bridge(4) works only with ethernet interfaces, and lo(4) isn't such a > thing. Has this always been the case? I'm almost certain that I set up jails with extra loopback devices that communicated over bridges back in the FreeBSD 6 days.

Filtering outbound traffic for private address jails?

2016-06-25 Thread org.freebsd.security
Hello. I have been searching for the best part of a day for a solution to this problem and quite frankly cannot believe that I've spent this long on something that appears to be so simple and that used to be fairly easy to achieve. Many years ago, I solved this problem on FreeBSD 6, but the way I

Re: ifconfig: BRDGADD lo1: invalid argument

2016-06-25 Thread org.freebsd.security
On 2016-06-25T19:16:06 + Marie Helene Kvello-Aune wrote: > Check that lo1 has same MTU as bridge0. > > Regards, > Marie Helene Hello! Yes, I checked that (as one of the responses from the original thread suggested). Both lo1 and em0 (the real network adapter) have an MTU of 1500. M _

ifconfig: BRDGADD lo1: invalid argument

2016-06-25 Thread org.freebsd.security
Hello. I'm trying to create a bridge interface to isolate some jails on private addresses. I'm on a near-pristine install of 10.3, updated to 10.3-p5 via freebsd-update. The virtual interface to which the jails will be bound: # ifconfig lo1 create The bridge: # ifconfig bridge create bridge0 #