VPN server to run in FreeBSD jail ...

[Matthew Seaman]

Marc G. Fournier wrote:

> Does anyone know of any software that would allow a client attach a VPN *to* a
> process running within a FreeBSD jail from a Windows machine?

I believe you can sort-of do this with a certain amount of packet
redirection and firewall trickery, but it isn't very easy and you won't
be able to control anything to do with the VPN from within the jail. 
Essentially you do the old trick of creating the jail using an alias
address on the loopback, then add redirection rules in the firewall to
forward traffic to it.  If you need to create tap, tun of gif interfaces
to run the VPN software then that has to be done *outside* the jail, as
there's no simple way of making those interfaces visible inside it.

It doesn't help now, but there is work underway to make the whole
network stack clonable under FreeBSD -- meaning each jail gets the
ability to have as many IP numbers as it wants, and to have a separate
firewall from the host system and do all the other networking tricks
you can think of.

    http://www.tel.fer.hr/zec/papers/zec-03.pdf

	Cheers,

	Matthew

-- 
Dr Matthew J Seaman MA, D.Phil.                       7 Priory Courtyard
                                                      Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey         Ramsgate
                                                      Kent, CT11 9PW

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 250 bytes
Desc: OpenPGP digital signature
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20070105/fd93ffa5/signature.pgp