jail translates destination IP?

Bjoern A. Zeeb bzeeb-lists at lists.zabbadoz.net
Thu Nov 20 10:42:02 PST 2008

On Thu, 20 Nov 2008, Eugene Grosbein wrote:


freebsd-jail@ is a good place to ask jail questiosn as well.

> For some strange reason, RAW sockets (when allowed) and TCP beheave
> very differently in jail (7.1-PRERELEASE). In host's rc.conf:
> jail_enable="YES"
> jail_list="test"
> jail_devfs_enable="YES"
> jail_test_rootdir="/mnt/big/jail/test"
> jail_test_hostname="myname.ru"
> jail_test_ip=""
> jail_test_interface="lo0"
> "/etc/rc.d/jail start" does all right and I may rlogin into jail.
> In host environment I run tcpdump -np -i lo0.
> Inside jail I ping, it succeedes and tcpdump shows that requests
> go from to really. But when I try to telnet 25
> from jail, tcpdump shows that TCP SYN are sent to, so telnet fails.
> There is no NAT here. It it a bug?

What happens with TCP is the expected behaviour.  I wonder more about
the raw socket case and am not sure this is correct.

jails try to "simulate" the non-existing loopback by re-writing the
IPs to the jail-IP, which obviously has other implications.
You should never be able to connect from inside the jail to the base
systems loopback IP. This is a known "feature" (limitation)
of jails. Full network stack virtualization will no longer have that


Bjoern A. Zeeb              Stop bit received. Insert coin for new game.

More information about the freebsd-net mailing list