Problem filtering port between host and jail.
demelier.david at gmail.com
Fri Jun 18 10:20:00 UTC 2010
2010/6/17 David DEMELIER <demelier.david at gmail.com>:
> Because I don't want to enable jail_sysvipc, I installed PostgreSQL on
> my host and it works fine. The problem is accessing a database within
> a jail.
> The jails are nat'ed and they can connect to the Internet. However
> trying psql -h 192.168.1.23 -U markand markanddb time out and said :
> psql: could not connect to server: Operation timed out
> Is the server running on host "192.168.1.23" and accepting
> TCP/IP connections on port 5432?
> my /etc/pf.conf is like :
> # General macros.
> host_ip = "192.168.1.23"
> # Nat for jails.
> nat on $ext_if from $jails to any -> $ext_if
> # Redirecting and accepting ports to jails.
> rdr pass inet proto tcp from any to port $ports_users -> $jail_users
> rdr pass inet proto tcp from any to port $ports_www -> $jail_www
> # Filtering ports.
> block log all
> # Filtering in.
> pass in on $ext_if proto tcp from any to port $ports
> # Filtering out.
> pass out all
> So I tried something like :
> pass out quick from $jails to host
> but it timeout too. With tcpdump I can see these messages :
> 00:00:12.202519 rule 0/0(match): block out on lo1:
> markand.malikania.fr.postgresql > 10.0.0.30.33431: tcp 20 [bad hdr
> length 0 - too short, < 20]
> I don't understand what i'm doing wrong here, if anyone can solve
> this, it would be great!
> Kind regards.
> Demelier David
Please ignore, I switched the jails to use the physical interface and
now it works.
More information about the freebsd-questions