I am trying to set up a jail that will serve as a default gateway for some of my external clients.
I have a VIMAGE jail that has a dedicated IP address in my local network which I want to use as a gateway for my clients. The reason that I am doing it, if important, is that I want to run OpenVPN inside that jail so all my clients using the jail's IP as a gateway would go through VPN transparently.
When I ssh into the jail everything works: I can see the Internet, even when I switch on OpenVPN it works as expected. However, it doesn't work as a default gateway for my clients: names don't get resolved, "no route to host", etc.
When I run tcpdump
inside the jail I see the following:
20:53:23.263597 IP 192.168.1.6.54460 > syd15s01-in-f78.1e100.net.https: UDP, length 109
20:53:23.263636 IP 192.168.1.6.54460 > syd15s01-in-f78.1e100.net.https: UDP, length 109
where 192.168.1.6
is the client's IP so I assume that the client tries to reach the Internet via the jail, but nothing comes back.
I sometimes see some ICMP
traffic too.
My ipfw
config is:
# less /usr/local/etc/ipfw.rules
#!/bin/sh
EPAIR=$(/sbin/ifconfig -l | tr " " "\n" | /usr/bin/grep epair)
INNER="$(/sbin/ifconfig | grep " -->" | cut -d' ' -f2 | cut -d'.' -f1-3).0/24"
ipfw -q -f flush
ipfw -q nat 1 config if ${EPAIR}
ipfw -q add nat 1 all from ${INNER} to any via ${EPAIR}
ipfw -q add nat 1 all from any to any in via ${EPAIR}
# ipfw add check-state
TUN=$(/sbin/ifconfig -l | tr " " "\n" | /usr/bin/grep tun)
ifconfig ${TUN} name tun0
I assume some NAT is missing somewhere, but I don't really understand what's going on so any help is appreciated.
What should I do to allow my clients' traffic to go through the jail/vpn when they use jail's IP as a default gateway?