Noob question about Jails networking conf
reddit / freebsd

----------------------------------------------------------------------
RafneQ · 2020-11-16 21:28

Hi there, quick question - is it a "big fail" to use simple network
configuration in Jails with aliases on host interface on LAN network ?

For example:

* host running ssh: em0 10.0.0.1, ipfw with opened ports 22, 666, 777
* jail1: em0 10.0.0.2 with some service on port 666
* jail2: em0 10.0.0.3 with some service on port 777
* jail.conf with `ip4=new;` and `ip4.addr =x.x.x.x;`

I am just starting with Jails and I don't know if I should get more
into firewall nat and port forwarding (or vnets) or maybe this simple
config with aliases is totally correct ? (please be gentle)

----------------------------------------------------------------------
Max-Normal-88 · 2020-11-16 23:18

I am a noob too, and because I haven’t studied firewall yet (bad) I
use “ipv4 = inherit;” on simple setups.

----------------------------------------------------------------------
RafneQ · 2020-11-17 00:16

Yeah, I started with the same config. I also don't have time to to
dive in into firewall config.

----------------------------------------------------------------------
michaelfatbender · 2020-11-17 04:06

With these kinds of things the answer is always, "it depends". But if
you're just playing around with jails and trying to set up some
services, them keeping it simple is a good way to go. Nothing wrong
with using aliases if that solves your problem.

----------------------------------------------------------------------
Yaazkal · 2020-11-17 13:35

Hi, I'll suggest this method only if you are the network administrator
and you have control over the IP assignment. Also, if you trust all
devices in the network.

If you want to try an alternative, you can check how Bastille
configures the host as in a "public network" scenario. Generally
speaking you create a loopback interface in the host and then create
some firewall rules so the jails can access the internet (NAT) and
also to redirect connections from specific port to specific jail using
rdr rules.

[https://github.com/BastilleBSD/bastille#network-
requirements](https://github.com/BastilleBSD/bastille#network-
requirements)

PS: I also recommend to use Bastille as your jail manager, check the
getting started section [https://bastillebsd.org/getting-
started/](https://bastillebsd.org/getting-started/) and the networking
section when you can check other networking scenarios [https://docs.ba
stillebsd.org/en/latest/chapters/networking.html](https://docs.bastill
ebsd.org/en/latest/chapters/networking.html)

I found the public network scenario easier.

----------------------------------------------------------------------
RafneQ · 2020-11-17 20:49

Thanks for the suggestion. I wanted to start and play a bit with
"pure" jails to get some basic overview how the things works. Going to
automated tools is the next step. I've heard about ezjail and iocage.
Never heard about Bastille but I will definitely check it out. Thanks
again !

----------------------------------------------------------------------
Yaazkal · 2020-11-17 21:34

Great. Is good to start with "pure jails" in order to understand the
core concepts. Take a look at the Bastille code, anyway is a shell
script. That way you can learn pure jails too :)

Regards!