Jail with public IP alias

[Frank Leonhardt]

On28/08/2013 00:19, Patrick wrote:
> On Tue, Aug 27, 2013 at 3:42 PM, Alejandro Imass <aimass at yabarana.com> wrote:
>> On Tue, Aug 27, 2013 at 6:28 PM, Patrick <gibblertron at gmail.com> wrote:
>>> That's not the behaviour I see. My jail has a private and public IP.
>>>
>> Hi Patrick, thanks for your reply.
>>
>> The issue is actually more basic and it's because the same network
>> card has multiple IPs on the same subnet so the routing table always
>> chooses the primary IP assigned to that interface.
>>
>> I'm trying to figure out if I can fix it in the routing table or will
>> need IPFW to re-write the source address.
>>
>> Thanks,
>>
>> --
>> Alejandro Imass
> Hi Alejandro,
>
> That's how I've got things setup, too, but I'm not seeing the same
> behaviour. So I was wondering if there was something different about
> your setup such as using NAT to allow a jail with a private IP to
> access the internet at large.
>
> Patrick
>
>
>

(Tidied up so all now bottom posted)

I can confirm that you shouldn't be seeing this behaviour because I 
don't. I don't use EzJail - i prefer "vi". Seriously, setting up a jail 
is very straightforward anyway, and when I tried ezjail I found it was 
doing stuff I didn't like, so dropped it early on. It was a long time 
ago and I've forgotten the specifics.

I guess if you're using it your new to this particular game, so please 
excuse me pointing out a few basics here.

Although I can't exactly see how this would cause a problem, remember 
that many service will bind to ALL IP addresses when they start up, and 
if they pinch a port any subsequent jail trying to take the same one 
will fail. For SSH, edit /etc/ssh/sshd_config on the "host OS" and set 
the ListenAddress to the one you want to use instead of the default, 
which means all of them.

I can't see a mechanism that would get the results you're seeing, but I 
don't know what ezjail might be doing. I suspect your problem is with 
ezjail or something bizzare on your network config; can you try it manually?

Regards, Frank.