3 ms·

I have a VNET jail for remote access to my home lab. This takes an extra NIC I wasn't using anyway. It has been solid running on FreeBSD 13.2. This jail allows

by idatum 3y ago

I have a VNET jail for remote access to my home lab. This takes an extra NIC I wasn't using anyway. It has been solid running on FreeBSD 13.2. This jail allows me to lock things down to minimal access to other services I need remotely, such as an SSH tunnel to Home Assistant. I run my FreeBSD server mainly for ZFS. Adding a jail for remote access adds to the usefulness that hardware.

appleflaxen 3y ago
Can you elaborate on what this looks like?
- idatum 3y ago
  jail.conf: ssh { exec.start = "/bin/sh /etc/rc"; exec.stop = "/bin/sh /etc/rc.shutdown"; exec.clean; mount.devfs; path = "/var/jail/ssh"; host.hostname = "ssh"; vnet; vnet.interface += "em0"; } It's IPv6 only, so this is key in rc.conf: rtsold_enable="YES" OpenBSD PF based router does the rest. IPv6 simplifies things here. PF on FreeBSD isn't the most ideal, sure, but I can limit local access on inet6. For SSH tunnel, it's straight forward.
  - inferiorhuman 3y ago
    FWIW VNET is not inherently IPv6 only. I'm using it in an IPv4 only context just fine.
toast0 3y ago
An extra NIC is fine if you've got slots, but you can also do an if_bridge in the main host, add the real nic and half of an if_epair; then move the other half to the vnet jail. Potentially a non-vnet jail with the ipv4/ipv6 options set may also be an option. I used to use jails with those settings to squeeze multiple environments into a single host at Yahoo.
- yakubin 3y ago
  I use only if_epair and then pf to NAT it to the external world. I’ve only had issues with if_bridge, where I would either be able to make connections between jail and the external world, but not between host and jail or vice versa (between host and jail fine, but not between jail and external world). And it would act really flaky, like getting one ping response, followed by silence. pf is a lot simpler and more reliable.
- jsjohnst 3y ago
  > I used to use jails with those settings to squeeze multiple environments into a single host at Yahoo. Greetings! Miss the ole days at the ‘Hoo when we were all FBSD based!

by idatum 3y ago

appleflaxen 3y ago

Can you elaborate on what this looks like?

idatum 3y ago
jail.conf: ssh { exec.start = "/bin/sh /etc/rc"; exec.stop = "/bin/sh /etc/rc.shutdown"; exec.clean; mount.devfs; path = "/var/jail/ssh"; host.hostname = "ssh"; vnet; vnet.interface += "em0"; } It's IPv6 only, so this is key in rc.conf: rtsold_enable="YES" OpenBSD PF based router does the rest. IPv6 simplifies things here. PF on FreeBSD isn't the most ideal, sure, but I can limit local access on inet6. For SSH tunnel, it's straight forward.
- inferiorhuman 3y ago
  FWIW VNET is not inherently IPv6 only. I'm using it in an IPv4 only context just fine.

toast0 3y ago

An extra NIC is fine if you've got slots, but you can also do an if_bridge in the main host, add the real nic and half of an if_epair; then move the other half to the vnet jail. Potentially a non-vnet jail with the ipv4/ipv6 options set may also be an option. I used to use jails with those settings to squeeze multiple environments into a single host at Yahoo.

yakubin 3y ago
I use only if_epair and then pf to NAT it to the external world. I’ve only had issues with if_bridge, where I would either be able to make connections between jail and the external world, but not between host and jail or vice versa (between host and jail fine, but not between jail and external world). And it would act really flaky, like getting one ping response, followed by silence. pf is a lot simpler and more reliable.
jsjohnst 3y ago
> I used to use jails with those settings to squeeze multiple environments into a single host at Yahoo. Greetings! Miss the ole days at the ‘Hoo when we were all FBSD based!