Firewalling jails and lo0

[Bjoern A. Zeeb]

On 8 Aug 2016, at 8:19, Niklaas Baudet von Gersdorff wrote:

> Ernie Luzar [2016-08-07 13:20 -0400] :
>
>>> Aha. So once I assigned those traffic from/to jails should go
>>> through lo1 solely?
>>
>> YES.
>
> Thank you for clarifying that and your help. So, I attached
> additional IP addresses on the jail host side accordingly:
…

> My issue can be reduced to the question: When using jails, to
> secure network traffic as best as I can, do I have to enable the
> firewall on lo0 or is enabling it on the interface they are
> attached to (in my case lo1) enough?
>
> And: What do I need to do to restrict jails from using lo0?

The problem I think is that the routes (see one of your earlier emails) 
for the jail loopback IP addresses are pointing to lo0 and not lo1.

If you’d manually issue a

route change -host -inet6  fd16:dcc0:f4cc:3::2:1 -iface lo1


Hmm probably not…


root at rabbit4:~ # ifconfig lo1 create
lo1: bpf attached
root at rabbit4:~ # ifconfig lo1 inet6  fd16:dcc0:f4cc:3::2:1/128 alias
root at rabbit4:~ # route get -inet6  fd16:dcc0:f4cc:3::2:1
    route to: fd16:dcc0:f4cc:3::2:1
destination: fd16:dcc0:f4cc:3::2:1
         fib: 0
   interface: lo0
       flags: <UP,HOST,DONE,STATIC>
  recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
        0         0         0         0     16384         1         0
root at rabbit4:~ # route change -host -inet6 fd16:dcc0:f4cc:3::2:1 -iface 
lo1
change host fd16:dcc0:f4cc:3::2:1: gateway lo1 fib 0
root at rabbit4:~ # route get -inet6 fd16:dcc0:f4cc:3::2:1
    route to: fd16:dcc0:f4cc:3::2:1
destination: fd16:dcc0:f4cc:3::2:1
         fib: 0
   interface: lo0
       flags: <UP,HOST,DONE,STATIC>
  recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
        0         0         0         0     16384         1         0


Still points to lo0.  That is interesting.   I think at this point you 
have to assume packets go over lo0 and firewall there.

I wonder if this is a bug or a feature …

/bz