Jail source address selection broken, patch for ping

[Juan F. Díaz y Díaz]

Mark, you can just run a jail with the setfib utility so you don't need to modify all your scripts.

# First you need to setup the routing table for each fib
# /etc/rc.local
setfib 1 route add default 10.1.1.1
setfib 1 route del 192.168.1.0/24

setfib 2 route add default 192.168.1.1
setfib 2 route del 10.1.1.0/24

# For each jail config define a fib id
# /etc/rc.conf
...
jail_NAME1_ip="10.1.1.2/24
jail_NAME1_fib="1"
...
jail_NAME2_ip="192.168.1.2/24
jail_NAME2_fib="2"

# Then just exec your jail with the setfib
setfib 1 jexec 1 bash

Regards

----- Original Message -----
From: "Mark Felder" <feld at feld.me>
To: freebsd-jail at freebsd.org
Sent: Monday, April 9, 2012 2:07:14 PM
Subject: Re: Jail source address selection broken, patch for ping

On Mon, 09 Apr 2012 11:50:35 -0500, Juan F. Díaz y Díaz
<jfd at mrecic.gov.ar> wrote:

> Mark, did you tried using the setfib utility?

No, and even if that could have helped I would probably have to modify
our monitoring software (Xymon/Hobbit/BigBrother) in undesirable ways to
have it launch every child process with setfib. This would certainly be
a nasty
hack and honestly networking should "just work" from within a jail;
utilities shouldn't have to be tricked into working with a jail's
network stack.

Here's the results of trying setfib, though:

root at xymon:/# setfib 0 fping 192.168.xxx.1 (censored for our privacy)
setfib: setfib: Function not implemented

Do you have to set some sysctl to get setfib to work in a jail, or does
it just not work in jails period?
_______________________________________________ freebsd-jail at freebsd.org
mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-jail To unsubscribe,
send any mail to "freebsd-jail-unsubscribe at freebsd.org"

-- 
Juan F. Diaz y Diaz

MRECIC
Esmeralda 1212 Piso 3 - Bs As, Argentina
+54 (11) 4819 7261

PGP ID 0x27911364 (http://pgp.mit.edu)