configuration of multiple IPs for a jail

[Bjoern A. Zeeb]

On Thu, 28 Jan 2010, tom at diogunix.com wrote:

Hi,

> Jase,
>
>> This behaviour has been addressed in RELENG_7 recently with r202924 [1].
>
> thank you very much. That's what I was watching out for :-).
> I somehow could not find that hint in all the resources I used.
>
>> This commit allows you to set : sysctl security.jail.ip4_saddrsel 0 ,
>> which makes the kernel use the first IP passed to jail (8) as the
>> default source address instead of the default behaviour which picks the
>> first matching ip for that jail on the interface.

That's not exactly true.  Source address uses the first "matching"
address for the destination on the outgoing interface if possible.
There is a route lookup involved as well.  So if you are serving more
than one subnet it won't necessarily be the first IP of the interface
seen within the jail.

For the case given, it most likely will, though.


> Just great. I run 7.2 stable on most machines and thanks to your information
> it will be much easier than what I meanwhile did to fix things.
>
>> A workaround (if you're not able to update to a RELENG_7 following that
>> commit) is to reorder your interface aliases in /etc/rc.conf ,so that
>> your primary jail ip has a lower alias # than any secondary ips for that
>> jail.
>
> Yes. I've meanwhile found exactly that out the hard way and by trial and
> error. Works nice (or however, it works), even when the kernel setting method
> of course is much more elegant.
>
>> Hope this helps,
>
> I did already.

Though it might help, if you only need it for postfix, using the
smtp_bind_address (and smtp_bind_address6) options might be more
elegant rather than using the hammer of forcing things in the kernel.
See man 5 postconf.

If more services across all jails should be using the intended
behavior using the sysctl and kernel is probably the right thing.

/bz

-- 
Bjoern A. Zeeb         It will not break if you know what you are doing.