iocage, vnet jail does not go outside

Jacques Foucry jacques+freebsd at
Fri Jul 23 18:04:47 UTC 2021

Le vendredi 23 juil. 2021 à 19:51:42 (+0200), Michael Gmelin à écrit:

Hello Michael,

> You need to enable some sort of NAT at your end, e.g. using pf. Traffic
> is leaving your host on a private IP.

I forgot to post the part of my pf.conf your right. I enabled a NAT (may be in
a wroing way):

ext_if = em0
int_if = "{lo0 lo1}"
bridge_if = bridge0

icmp_types="{ echoreq, unreach }"

# ok loopback
set skip on lo0
set skip on lo1
#set skip on bridge0

# define jails
jails_net = "{ 2a01:4f9:4a:1fd8::/64}"


# nat
nat on $ext_if from $jails_net to any -> $ext_if


# ExampleJail
rdr on $ext_if inet proto tcp from any to $ext_if port $examplejail_ports -> $examplejail_v4
rdr on $ext_if inet6 proto tcp from any to $ext_if port $examplejail_ports -> $examplejail_v6


pass in log quick on $ext_if proto tcp from any to $examplejail_v4 port $examplejail_ports flags S/SA keep state
pass in log quick on $ext_if proto tcp from any to $examplejail_v6 port $examplejail_ports


# Allow icmp
pass in inet proto icmp all icmp-type $icmp_types
#IPv6 - pass in/out all IPv6 ICMP traffic
pass in quick proto icmp6 Allow

Is there something wrong of missing? I was guessing that the NAT is correct
because I can connect from outside (IPv4 and IPv6) to this jail.

Thanks again for your time.
Jacques Foucry

More information about the freebsd-questions mailing list