Jails and IP Aliasing

Matthew Seaman m.seaman at infracaninophile.co.uk
Tue Jul 8 16:35:32 UTC 2008

David Allen wrote:
> There was a post recently (Matthew Seaman's name comes to mind) that
> suggested binding jails to addresses in the loopback range and then
> using firewall rules to redirect the traffic accordingly.  There's a
> possibility that may help in this case, but that layer of added
> complexity isn't much of an improvement over seeing connections with
> seemingly identical endpoints and interpreting the results in my head.

Guilty as charged M'lud.

However what I recommended was a more-than-slightly hacky way to achieve 
three things:

   * Something like a loopback address inside the jail.  It may be instead of but most software can be persuaded
     to use it for loopback style things.

   * The ability to map several IPs onto the jailed system by use of
     NAT and redirect within firewall rules

   * The ability to have a jail with /no/ external IP for when the
     paranoia becomes unbearable[*].

Of course, all this will be immediately obsoleted by Marco Zec's work
on virtualizing the IP stack.  http://imunes.tel.fer.hr/virtnet/



[*] Combine this with a Hardware Load Balancer that does Direct Server
Return and you can have a publicly accessible jailed server with /no 
external IP address/.  

Dr Matthew J Seaman MA, D.Phil.                   7 Priory Courtyard
                                                  Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey     Ramsgate
                                                  Kent, CT11 9PW

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 258 bytes
Desc: OpenPGP digital signature
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20080708/8c1a3051/signature.pgp

More information about the freebsd-questions mailing list