Jails and IP Aliasing
the.real.david.allen at gmail.com
Tue Jul 8 19:54:34 UTC 2008
On Tue, Jul 8, 2008 at 9:35 AM, Matthew Seaman
<m.seaman at infracaninophile.co.uk> wrote:
> David Allen wrote:
>> There was a post recently (Matthew Seaman's name comes to mind) that
>> suggested binding jails to addresses in the loopback range and then
>> using firewall rules to redirect the traffic accordingly. There's a
>> possibility that may help in this case, but that layer of added
>> complexity isn't much of an improvement over seeing connections with
>> seemingly identical endpoints and interpreting the results in my head.
> Guilty as charged M'lud.
Stand up, fool, lest I be forced to lower my knee and acknowledge your presence
in a manner befitting a man as yourself.
> However what I recommended was a more-than-slightly hacky way to achieve
> three things:
> * Something like a loopback address inside the jail. It may be
> 127.0.0.2 instead of 127.0.0.1 but most software can be persuaded
> to use it for loopback style things.
> * The ability to map several IPs onto the jailed system by use of
> NAT and redirect within firewall rules
> * The ability to have a jail with /no/ external IP for when the
> paranoia becomes unbearable[*].
It could be said that those three expand into more numerous
achievements. I'm still debating the "more-than-slightly hacky" aspects
of such an arrangement, but undeniably it's interesting enough.
> Of course, all this will be immediately obsoleted by Marco Zec's work
> on virtualizing the IP stack. http://imunes.tel.fer.hr/virtnet/
Promising, even exciting, but I'm having trouble deciding whether I
declare a victory for the triumph of optimism over experience, or
offer the comment that the Real Soon Now schedule is a disappointment?
Seriously, though, jails can be seen as the greatest thing since slide bread,
but I have this nagging feeling I'm at work writing a small book that details
their niggly shortcomings, a book whose completion, I hope, will be cut
short by the addition of New and Improved features.
More information about the freebsd-questions