dhclient(8) sets wrong interface netmask on boot up

Warren Block wblock at wonkity.com
Sat Sep 12 18:24:15 UTC 2015

On Sat, 12 Sep 2015, Cary wrote:
> On 09/12/2015 10:45, Adam Vande More wrote:
>>> [/etc/rc.conf]
>>> hostname="public.fbsd.local"
>>> ifconfig_em0="DHCP"
>>> cloned_interfaces="${cloned_interfaces} lo1"
>> previous line doesn't make much sense.
> That was copied from the FreeBSD handbook section on managing jails
> (https://www.freebsd.org/doc/handbook/jails-ezjail.html). I didn't think
> that the jails would mess with the base host network configuration.

Well, they add aliases.  The cloned_interfaces line lets the jails use a 
separate loopback interface from the host.

> However, after re-looking at the jail config, I changed the config line
> in /usr/local/etc/ezjail/www_local from:
> export jail_www_local_ip="lo1|,em0|"
> to
> export jail_www_local_ip="lo1|"

Wait, you were assigning the host's IP address to the jail?  That's the 

> After reboot, I was able to SSH into it without trouble. But now the
> httpd server cannot bind to the em0 interface. I guess I can forward
> traffic with ipfw or pfctl to get around that issue.
> LESSON LEARNED: ezjail *will* override the DHCP-assigned configuration
> of an interface!

Well... when the jail is reusing the host's IP address, yes.  Jails use 
aliases, and the netmask for an alias is 0xffffffff ( 
So the host got an IP address and valid netmask from the DHCP server at 
boot, then the jail startup reassigned the same IP address to the host 
as an alias, setting an alias netmask.  From earlier posts:

>> <       inet netmask 0xffffffff broadcast
>> ---
>>>       inet netmask 0xffffff00 broadcast

It's a little surprising that didn't fail with an error.

The current setup (not specifying an IP address for the jail) ends up 
using the host's IP address again.  That also seems like a mistake, but 
maybe not.

More information about the freebsd-questions mailing list