Re: jail source address selection doesn't work?

On Thu, 3 Mar 2011, Alex Povolotsky wrote:

Hi,

03.03.2011 0:48, Bjoern A. Zeeb пишет:
On Mon, 7 Feb 2011, Alex Povolotsky wrote:

Okay, yes?

From jail:

...

What could I miss?...

Don't use ping to test this. a) for ping inside the jail to work you
need to enable raw sockets b) a) could give you a hint that ping does
it's own thing.
Telnet did all the same thing.

Try a telnet to a random port to the destination and verify with
tcpdump whether things are still not working correctly, of if you
establish the connection with netstat.
I used telnet to connect to specific ports.

Ok, let's try again

104:tarkhil@xxxxxxxxxxxxxxxxxxxxxxx:...local/etc/ezjail # jls
JID IP Address Hostname Path
1 192.168.82.2 test /usr/jails/test
107:tarkhil@xxxxxxxxxxxxxxxxxxxxxxx:...local/etc/ezjail # jls -j 1 ip4.saddrsel
true
108:tarkhil@xxxxxxxxxxxxxxxxxxxxxxx:...local/etc/ezjail # jls -j 1 ip4.addr
192.168.82.2,192.168.75.2
114:tarkhil@xxxxxxxxxxxxxxxxxxxxxxx:...local/etc/ezjail # tcpdump -l -n -i bce0 host 192.168.82.2
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bce0, link-type EN10MB (Ethernet), capture size 96 bytes
09:27:54.492105 IP 192.168.82.2.50823 > 192.168.72.3.22: Flags [S], seq 3819433473, win 65535, options [mss 1460,nop,wscale 3,sackOK,TS val 1306232522 ecr 0], length 0
...
inet 192.168.80.41 netmask 0xffffff00 broadcast 192.168.80.255
inet 192.168.75.2 netmask 0xffffff00 broadcast 192.168.75.255
inet 192.168.82.2 netmask 0xffffff00 broadcast 192.168.82.255
..
In other words, source address is selected as primary IP, and packet runs out on 100% improper interface.

No specific routing, no firewall.

Not sure what you expect. Your jail has an address out of
192.168.82.2/24 and
192.168.75.2/24

You are trying to connect to neither of those networks but 192.168.72.3.

Given the destination network does not match any directly connected
network and, based on your previous email, you don't have an route going out a gateway of either of those two networks to 192.168.72.3 it's doing
the fallback to the "primary" jail IP, as expected.

You would need to add a more specific route to the destination via a
gateway of either connected network if you wanted a different source
address to be picked; if you just want to limit that to the single
jail but not the global system look at setfib for IPv4.

/bz

--
Bjoern A. Zeeb You have to have visions!
Stop bit received. Insert coin for new address family._______________________________________________
freebsd-net@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: VPN and remote gateway
    ... 317025, we could know that if you use local gateway, your internet connection will not be a problem, but, you could not access your ... remote network since there is no route between you computer and your remote company network. ...
    (microsoft.public.windows.server.sbs)
  • Re: Network connected but no IP address
    ... To make sure that the NIS firewall isn't blocking the gateway ??router??, open NIS and add the gateway ??router?? ... To minimize any conflicts while working to resolve this issue Uninstall Any/All devices listed in Device Manager> Network Adapters. ... Shut down and remove the wireless NIC. ... What components/protocols are listed as installed in the NIC connection properties? ...
    (microsoft.public.windowsxp.general)
  • Baffling DNS Problem
    ... Network Diagnostics for Windows XP also states a DNS problem in the log ... - internet connection works just fine when switched over to my MacBook ... Gateway Diagnostic ... Wireless Diagnostic ...
    (microsoft.public.windowsxp.network_web)
  • RE: Remote Access problems
    ... I have been unable to attempt changing the gateway as of yet. ... Over the PPP connection, Outlook connects to exchange fine, you can print, ... > Since the remote client uses a SBS VPN connection package, ... Click Start, click Control Panel, click Network and Internet ...
    (microsoft.public.windows.server.sbs)
  • Re: Internet Gateway
    ... the network services for gateway, and all seems back to normal (well, I then ... connection', and this was the only connection that was ever enabled. ... However, today there has appeared another connection, under Internet ...
    (microsoft.public.windowsxp.network_web)