for a jail that doesn't have a public ip, and only has a private lan ip, i guess i don't set a default gateway address?

or do i make the jail host be the default gateway or? how do i know pls?

depends if the jail has its own network stack

ya it's vnet

on the host check, jls -N

and jexec nameofjail ifconfig

ok you're just telling me commands but WHY

like what's the point

it either shares the hosts network or has its own

i said it has vnet

my bad that you said vnet already, so the only thing left is what the jails epair is pluggeed into the host thats what decides the next hop

is your nic a physical member?

don't even know what your'e asking or why. i'm back at the conceptual stage. if a jail is only intended to have a private lan ip, it doesn't get a default gateway address configured right?

kinda rude for someone trying to help your vague question

agree to disagree

good luck

ya helping ppl usually involves actually reading their question and understanding what their goal is instead of just blurting shit out

ok, well you'll find what you're looking for eventully. need to remember that some people do this for a living.

later

for the record, public vs private has nothing to do with it. What matters is whether traffic actually leaves the subnet and pkg, dns, ntp all do so yes it gets a default gateway and since it's 'VNET' with its own routing table you set it in the jail ' defaultrouter="yourlanrouter", same address every other box on that lan uses.

the epair/bridge stuff i was asking about only matters if your setup isn't the simple bridged case. Which I was trying to establish...

jail uses host time so ntp is irrelevant afaik. pkg for the jail is also ran by the host. and there's no dns. this is all so that jails can be on a private lan, doing specific work in a service-oriented architecture, behind another jail that does have a public ip and proxies to the others on the private lan

yeah if the private jails only ever talk to the proxy jail on the same subnet then no default route needed at all. Now we know that nothing leaves the subnet. Also pkg -j runs pkg inside the jail, so with vnet it uses the jail network and dies with no route. use pkg -r /path/to/your/jail/ so the host fetches. If the proxy jail is on a diff subnet then the privat ones they do need a route back to it. static or default either way.

Oh, I need to think about that. I've set up NAT so I could reach out from my jails, but maybe I don't actually need it.

pkg -r

proxy jail has 2 epair nics. 1 with public ip and 1 with ip on private lan

mason ya i'm converting my jails to not need internet by default by using freebsd-update -j and pkg -r

nice nice

I've said this in here before, but my latest move is off of epair/vnet and onto old-fashioned networking for jails. I'm loving it.

I think the next move for me would have to be off of jails entirely and back to chroots. :P

why and how?

Why? Simplicity. How? I spin up a new lo interface for them to sit on, with a private subnet, and then just port forward in as needed, and NAT out, although clearly the NAT is optional.

ya that's cool. i'll still keep using vnet except for service jails that are just app containment but i see the value