2

I am trying to set up a jail that will serve as a default gateway for some of my external clients.

I have a VIMAGE jail that has a dedicated IP address in my local network which I want to use as a gateway for my clients. The reason that I am doing it, if important, is that I want to run OpenVPN inside that jail so all my clients using the jail's IP as a gateway would go through VPN transparently.

When I ssh into the jail everything works: I can see the Internet, even when I switch on OpenVPN it works as expected. However, it doesn't work as a default gateway for my clients: names don't get resolved, "no route to host", etc.

When I run tcpdump inside the jail I see the following:

20:53:23.263597 IP 192.168.1.6.54460 > syd15s01-in-f78.1e100.net.https: UDP, length 109
20:53:23.263636 IP 192.168.1.6.54460 > syd15s01-in-f78.1e100.net.https: UDP, length 109

where 192.168.1.6 is the client's IP so I assume that the client tries to reach the Internet via the jail, but nothing comes back. I sometimes see some ICMP traffic too.

My ipfw config is:

# less /usr/local/etc/ipfw.rules
#!/bin/sh

EPAIR=$(/sbin/ifconfig -l | tr " " "\n" | /usr/bin/grep epair)
INNER="$(/sbin/ifconfig | grep " -->" | cut -d' ' -f2 | cut -d'.' -f1-3).0/24"
ipfw -q -f flush
ipfw -q nat 1 config if ${EPAIR}
ipfw -q add nat 1 all from ${INNER} to any via ${EPAIR}
ipfw -q add nat 1 all from any to any in via ${EPAIR}
# ipfw add check-state

TUN=$(/sbin/ifconfig -l | tr " " "\n" | /usr/bin/grep tun)
ifconfig ${TUN} name tun0

I assume some NAT is missing somewhere, but I don't really understand what's going on so any help is appreciated.

What should I do to allow my clients' traffic to go through the jail/vpn when they use jail's IP as a default gateway?

Improve this question

1 Answer 1

Reset to default
1

FreeBSD jails are basically a sort of lightweight virtualization, so it's best purpose - is to run some applications as containers. It surely has a network stack, but, comparing its functionality with a functionality of a host systems I'd say it's rather limited.

So chosing a jail as a container router seems to be a bad choice. What you should do - is to use multiple FIBs. By the way same approach applies to all the modern netwroked OSes - Linux, JunOS, Cisco IOS etc.

I would recommend to add net.fibs="4" into /boot/loader.conf, then reboot and use multiple routing tables. This way you can start your OpenVPN gateway in s separate FIB like setfib 1 /usr/local/bin ... whatever, then assign your clients traffic to it using setfib in ipfw or by directly assigning your clients interfaces to this FIB.

Improve this answer
2
  • Thanks! How do I "assign clients traffic"? I want it to be controlled from the client such as if the client chooses to use VPN gateway it gets there. Does each "fib" has its own IP address to use as a gateway?
    – Alexey Raga
    Oct 17, 2016 at 22:51
  • Each FIB is a full-fledged routing table, including, of course, a default route. You can assign traffic to a FIB using many ways - using the originating interface (by putting this interface into a separate fib using ifconfig <iface> fib X), but I don't see how you can control traffic from clients.
    – drookie
    Oct 18, 2016 at 4:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .