I have the following setup with FreeBSD jails and VNET which is supposed to grow into a DNS core net lab setup. The jailhost and the jails are running FreeBSD 12.1. The jails are connected by epair
interfaces. The BRAS jail which is supposed to act as the network's edge router is connected to the jail host by epair
interfaces. The jailhost runs a pf based NAT
I can reach hosts in the WAN from the BRAS jail without a problem. The problem is that I cannot reach anything behind the BRAS jail from the DNS. Forwarding on the BRAS is enabled and the pf rules for the NAT are broad enough to allow traffic from the DNS's network.
If I understood it correctly I don't need multiple fibs on the jailhost using VNET, please correct me if I'm wrong. That part of jails is not documented too well.
root@bras:/ # netstat -r
Routing tables
Internet:
Destination Gateway Flags Netif Expire
default 172.16.3.1 UGS epair8b
localhost link#1 UH lo0
172.16.1.0/30 link#4 U epair7a
172.16.1.1 link#4 UHS lo0
172.16.3.0/30 link#5 U epair8b
172.16.3.2 link#5 UHS lo0
root@dns:/ # netstat -r
Routing tables
Internet:
Destination Gateway Flags Netif Expire
default 172.16.1.1 UGS epair7b
localhost link#1 UH lo0
172.16.1.0/30 link#2 U epair7b
172.16.1.2 link#2 UHS lo0
# pf.conf jailhost
ext_if="vtnet0"
jail_if="epair8a"
IP_PUB="redacted"
IP_JAIL="172.16.3.1"
NET_JAIL="172.16.0.0/16"
scrub in all
nat pass on $ext_if from $NET_JAIL to any -> $IP_PUB