3 ms·
>At the end all of your jails end up on the same loopback interface, making it hard to firewall. I couldn't find a way to have one network interface per jail.
by mortenlarsen 5y ago
>At the end all of your jails end up on the same loopback interface, making it hard to firewall. I couldn't find a way to have one network interface per jail.
FreeBSD jails has quite a bit of history (developed in 1998) and made public in the year 2000.
FreeBSD has had VNET for use with jails allowing you to add epair interfaces connected to a bridge, or add a physical interface or VLAN to a jail. This feature has been in FreeBSD since 8.0 (2009) and enabled by default since 2018. It also allows you to run PF in each jail.
Sadly many people a bitten by outdated forum and blog posts when it comes to jails.
I agree that firewalling jails with loopbacks is a pain, but most people don't do it that way anymore.
Also PF has always had atomic reloads.
- ybloviator 5y agoYeah, it's a weird argument. I've used vnet, but rarely need it. I bind my jails to their own IPs and that's that. That has been available from the very early days of jails. Again, mature, simple and secure, with very few surprises lurking. There's likely fewer lines of code to support all jail functionality than in systemd.