quick question regarding jails.

[David Allen]

On Fri, Jul 18, 2008 at 1:46 AM, Wojciech Puchar
<wojtek at wojtek.tensor.gdynia.pl> wrote:
>>
>> Just wondering if a box has 2 Ethernet cards with each card going to a
>> different gateway/network, is it possible to stick a jail on the machine
>> listening on one network interface and routing data out one
>> card/network/gatway while the rest of the system uses the other port and
>> gateway/network.
>
> yes - no problem

For most values of "yes".  For others, the answer is "It depends."

Yes, you can configure daemons running on the host to bind to one
interface, and configure daemons running on the jail to bind to a
different interface.   However, host <-> jail communications occur over
loopback and "routing data" between the two, if that's the question being
asked, has its limitations.

I brought up this problem just recently.

http://docs.freebsd.org/cgi/getmsg.cgi?fetch=407605+0+archive/2008/freebsd-questions/20080713.freebsd-questions

To sum up, if jail host running at 10.0.0.1 connects to a jail running at
10.0.0.2, the traffic will occur over lo0, and BOTH endpoints of that
connection will use the jail (10.0.0.2) address.  To my mind, that can be
problematic.

You can modify the routing table so that a host -> jail connection exits
an actual interface (and uses that interface's IP address).  However, this
offers limited usefulness as you can't do the same on the jail side
(there's only one routing table to speak of), and return traffic won't be
seen on that interface.

The above applies irrespective of whether the jail host and the jail are
on the same or different network, or on the same or different NICs.