I have the following setup with FreeBSD jails and VNET which is supposed to grow into a DNS core net lab setup. The jailhost and the jails are running FreeBSD 12.1. The jails are connected by
epair interfaces. The BRAS jail which is supposed to act as the network's edge router is connected to the jail host by
epair interfaces. The jailhost runs a pf based NAT
I can reach hosts in the WAN from the BRAS jail without a problem. The problem is that I cannot reach anything behind the BRAS jail from the DNS. Forwarding on the BRAS is enabled and the pf rules for the NAT are broad enough to allow traffic from the DNS's network.
If I understood it correctly I don't need multiple fibs on the jailhost using VNET, please correct me if I'm wrong. That part of jails is not documented too well.
root@bras:/ # netstat -r Routing tables Internet: Destination Gateway Flags Netif Expire default 172.16.3.1 UGS epair8b localhost link#1 UH lo0 172.16.1.0/30 link#4 U epair7a 172.16.1.1 link#4 UHS lo0 172.16.3.0/30 link#5 U epair8b 172.16.3.2 link#5 UHS lo0
root@dns:/ # netstat -r Routing tables Internet: Destination Gateway Flags Netif Expire default 172.16.1.1 UGS epair7b localhost link#1 UH lo0 172.16.1.0/30 link#2 U epair7b 172.16.1.2 link#2 UHS lo0
# pf.conf jailhost ext_if="vtnet0" jail_if="epair8a" IP_PUB="redacted" IP_JAIL="172.16.3.1" NET_JAIL="172.16.0.0/16" scrub in all nat pass on $ext_if from $NET_JAIL to any -> $IP_PUB