different default gateway for jails planed/possible?
Emanuel Strobl
Emanuel.strobl at gmx.net
Mon May 30 15:14:55 PDT 2005
Dear all,
will it be possible to define a different default gateway for a jail?
Imagine a system with two interfaces, one for the host on a local GbE
Switch (with NFS service) and the other one connected to a different
DMZ-Switch which should serve different jails.
Now the DMZ is useless since anybody who broke into one jail can reach all
hosts on the "host" interface without having the possibillity to restrict
traffic on the router since the packets go straight to the GbE interface.
This is a big security disadvantage and if I block these packets I can't
any longer connect from machines inside the GbE network to the jails in
the DMZ. The request will be routed but answers go down the "host"
interface, instead to the DMZ router interface. Even a different default
gateway wouldn't help in this case, the kernel had to "keep in mind" that
packets from a jail mustn't be forwarded through any jail-foreign
interface. Also the usual routing table had to be overwritten since
packets from a jail should go over the router to the GbE network (although
there is a well known route, the interface which has the GbE net
configured).
But at least packets from a jail should be limited that they can't pass any
other interface(s) than the one(s) which belong to the particular jail.
I think PFs route-to next-hop rule would be a workarround for my problem
but I'm not too happy to have PF on a GbE Fileserver.
Another jail question: Is it possible to limit resources on jail-basis?
Like resource restrictions for useres in login.conf only for whole jails.
Thanks a lot,
-Harry
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-current/attachments/20050531/86e09c7d/attachment.bin
More information about the freebsd-current
mailing list