Problem filtering port between host and jail.

David DEMELIER demelier.david at
Thu Jun 17 19:58:52 UTC 2010


Because I don't want to enable jail_sysvipc, I installed PostgreSQL on
my host and it works fine. The problem is accessing a database within
a jail.
The jails are nat'ed and they can connect to the Internet. However
trying psql -h -U markand markanddb time out and said :

psql: could not connect to server: Operation timed out
	Is the server running on host "" and accepting
	TCP/IP connections on port 5432?

my /etc/pf.conf is like :

# General macros.
host_ip = ""

# Nat for jails.
nat on $ext_if from $jails to any -> $ext_if

# Redirecting and accepting ports to jails.
rdr pass inet proto tcp from any to port $ports_users -> $jail_users
rdr pass inet proto tcp from any to port $ports_www -> $jail_www

# Filtering ports.
block log all

# Filtering in.
pass in on $ext_if proto tcp from any to port $ports

# Filtering out.
pass out all

So I tried something like :

pass out quick from $jails to host

but it timeout too. With tcpdump I can see these messages :

00:00:12.202519 rule 0/0(match): block out on lo1: >  tcp 20 [bad hdr
length 0 - too short, < 20]

I don't understand what i'm doing wrong here, if anyone can solve
this, it would be great!

Kind regards.

Demelier David

More information about the freebsd-questions mailing list