ipnat.conf - map and rdr won't work!
norgaard at locolomo.org
Tue Jul 20 18:54:51 UTC 2010
On 20/07/10 20.07, alexus wrote:
> On Tue, Jul 20, 2010 at 12:57 PM, Erik Norgaard<norgaard at locolomo.org> wrote:
> plan b is to run natd, but i'd rather run ipnat especially that ipnat
> used to work before no problem!
Maybe move away from what used to work and towards what is working :)
Whichever you prefer, just stick to one solution only.
> su-3.2# ping -c1 lama
> PING lama (172.16.172.16): 56 data bytes
> 64 bytes from 172.16.172.16: icmp_seq=0 ttl=64 time=0.075 ms
> --- lama ping statistics ---
> 1 packets transmitted, 1 packets received, 0.0% packet loss
> round-trip min/avg/max/stddev = 0.075/0.075/0.075/0.000 ms
> ip address tells me that this is in fact jail's IP
Yes and no, if you shut down your jail you should still be able to ping
that ip as I read your snippet from your rc.conf.
>> So I suppose that from your host environment you can ssh into the jail? Did
>> ssh start up, netstat -l? From the jail, can you ping the host environment?
> su-3.2# jls
> JID IP Address Hostname Path
> 1 172.16.172.16 lama /usr/jail/lama
> su-3.2# jexec 1 /etc/rc.d/sshd status
> sshd is running as pid 1085.
> su-3.2# ps -p 1085
> PID TT STAT TIME COMMAND
> 1085 ?? IsJ 0:00.00 /usr/sbin/sshd
OK, but you didn't check where your ssh binds.
> i know, i can run it that IP address as an alias on public interface,
> but we on purpose added another NIC to be private NIC.
Well, read the man jail(8):
A comma-separated list of IPv4 addresses assigned to the prison.
If this is set, the jail is restricted to using only these
address. Any attempts to use other addresses fail, and attempts
to use wildcard addresses silently use the jailed address
If I understand this correctly, remove the line
from your rc.conf and your jail can then bind to port 22 on the external
interface thus bypassing the need for nat. This is ok, since all you did
was redirecting traffic. And the map rule shouldn't be necessary either,
nor should the fxp interface.
More information about the freebsd-questions