Comments (3)
I'm using prestart/poststart hooks with combination of anchors to add and remove this per jail basis.
from libioc.
Would you mind sharing how, exactly?
from libioc.
So first of all some related pf.conf configuration. I'm using a separate lo1 interface to handle all the traffic.
table <jails> persist counters
nat-anchor "jail-nat/*"
rdr-anchor "jail-rdr/*"
pass quick log on lo0 from <jails> to $jail_out # allow connection from jail to external IP
pass quick on lo1 from <jails> to 172.16.0.1. # DNS for jails
Might be that some lines are missing but I hope you get the idea of how to dynamically handle this.
Poststart hook
- add current IP to jails table
- create rule on the anchor (jail interconnection, this example only allow connect to itself)
- create nat on the anchor (I allow only http and https)
#!/usr/bin/env sh
# -e If non interactive then exit immediately if a command fails.
# -u Treat unset variables as an error when substituting.
# -v Print shell input lines as they are read.
# -x Print commands and their arguments as they are executed.
set -e
# get current jid
_name=$IOC_ID
_jid=$IOC_JID
_ip=$(echo "$IOC_IP4_ADDR" | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}')
_if=$(echo "$IOC_IP4_ADDR" | cut -d"|" -f1)
_eif="igb0"
# FW
printf " + Allow outbound access "
pfctl -t jails -T add $_ip 2>/dev/null
printf "pass on $_if from $_ip to $_ip\n" | pfctl -a "jail/$_name" -f -
echo "nat on $_eif inet proto tcp from $_ip to ! $_ip port "{ http, https }" -> (igb0:0)" | pfctl -a "jail-nat/$_name" -f -
Prestop hook
- remove IP from jails table
- remove rules for the anchor
- remove nat from the anchor
#!/usr/bin/env sh
# -e If non interactive then exit immediately if a command fails.
# -u Treat unset variables as an error when substituting.
# -v Print shell input lines as they are read.
# -x Print commands and their arguments as they are executed.
set -e
_name=$IOC_ID
_jid=$IOC_JID
_ip=$(echo "$IOC_IP4_ADDR" | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}')
_if=$(echo "$IOC_IP4_ADDR" | cut -d"|" -f1)
# FW
pfctl -t jails -T delete $_ip 2>/dev/null
pfctl -a "jail/$_name" -F rules 2>/dev/null
pfctl -a "jail-nat/$_name" -F nat 2>/dev/null
from libioc.
Related Issues (20)
- Exporting ZFS basejails includes basejail datasets
- provisioning does not cleanup mounted resources HOT 1
- ioc pkg no longer works HOT 2
- `ioc destroy -f` should call `ioc stop -f` HOT 3
- DHCP no longer works HOT 3
- Disable sendmail, for real please
- Symlink race condition
- Broken create Jail with net address already available on host HOT 3
- FreeBSD package names can contain dots
- Exporting jails fails with AbsolutePath error
- Unable to build under 12.1-p2 (python3.7)
- ZFS root dataset is not mounted HOT 1
- METADATA is incomplete
- Missing files in sdist
- fdescfs is no longer necessary HOT 1
- libioc's pkg feature can conflict badly with its provisioning feature HOT 1
- Network's __create_new_epair_interface function parameter nic_suffix_b is ignored
- Export without fstab fails
- EOL Warnings fail download on FreeBSD 13
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from libioc.