for a jail that doesn't have a public ip, and only has a private lan ip, i guess i don't set a default gateway address?

or do i make the jail host be the default gateway or? how do i know pls?

depends if the jail has its own network stack

ya it's vnet

on the host check, jls -N

and jexec nameofjail ifconfig

ok you're just telling me commands but WHY

like what's the point

it either shares the hosts network or has its own

i said it has vnet

my bad that you said vnet already, so the only thing left is what the jails epair is pluggeed into the host thats what decides the next hop

is your nic a physical member?

don't even know what your'e asking or why. i'm back at the conceptual stage. if a jail is only intended to have a private lan ip, it doesn't get a default gateway address configured right?

kinda rude for someone trying to help your vague question

agree to disagree

good luck

ya helping ppl usually involves actually reading their question and understanding what their goal is instead of just blurting shit out

ok, well you'll find what you're looking for eventully. need to remember that some people do this for a living.

later

for the record, public vs private has nothing to do with it. What matters is whether traffic actually leaves the subnet and pkg, dns, ntp all do so yes it gets a default gateway and since it's 'VNET' with its own routing table you set it in the jail ' defaultrouter="yourlanrouter", same address every other box on that lan uses.

the epair/bridge stuff i was asking about only matters if your setup isn't the simple bridged case. Which I was trying to establish...

jail uses host time so ntp is irrelevant afaik. pkg for the jail is also ran by the host. and there's no dns. this is all so that jails can be on a private lan, doing specific work in a service-oriented architecture, behind another jail that does have a public ip and proxies to the others on the private lan

yeah if the private jails only ever talk to the proxy jail on the same subnet then no default route needed at all. Now we know that nothing leaves the subnet. Also pkg -j runs pkg inside the jail, so with vnet it uses the jail network and dies with no route. use pkg -r /path/to/your/jail/ so the host fetches. If the proxy jail is on a diff subnet then the privat ones they do need a route back to it. static or default either way.

Oh, I need to think about that. I've set up NAT so I could reach out from my jails, but maybe I don't actually need it.

pkg -r

proxy jail has 2 epair nics. 1 with public ip and 1 with ip on private lan

mason ya i'm converting my jails to not need internet by default by using freebsd-update -j and pkg -r

nice nice

I've said this in here before, but my latest move is off of epair/vnet and onto old-fashioned networking for jails. I'm loving it.

I think the next move for me would have to be off of jails entirely and back to chroots. :P

why and how?

Why? Simplicity. How? I spin up a new lo interface for them to sit on, with a private subnet, and then just port forward in as needed, and NAT out, although clearly the NAT is optional.

ya that's cool. i'll still keep using vnet except for service jails that are just app containment but i see the value

so i got a jail host and vnet jail with no public ip, only private ip. i want to ssh to jail host port 555 and have it redirect to the jail's private ip and port 22. on jail host i made pf rule `rdr pass on pubif proto tcp from any to any port 555 -> 192.168.0.5 port 22` then it says blocking from bridge0 to 192.168.0.5, so i add pass on bridge,

reload pf, now i ssh to jail host port 555 but nothing happens. what i'm doing wrong pls?

i don't have a nat rule set maybe that's it? also don't have a default gateway set for jail

kerneldove: I'd personally just ssh with the host as a proxyjump.

personally I never use VNET jails unless there's a true need for it - feels overly-complicated. no epairs, no bridges, just an alias on the host and you can do that even if you have an int and ext network on two ports on your host.

it is complex, thats why you automate it so it becomes simple, but generally agreed.

working on automating it now

i want vnet for max security because i'm giving jails out to friends as virtual freebsd systems

Complexity as in many moving parts, more than anything. Fewer moving parts == good.

Anyway, g'night.

well i had a perfect configuration for jails that have their own public ip (and private ip) i'm switching now to not requiring jails to have a public ip so that requires quite a bit of chnages. i'll hammer on that and eventually get it solid too

my goal is to eventually take the 'anonssh' program I wrote and turn it into 'minijail', so you can launch any program in a jail and only include that programs dependencies. So much less than base. A single user, maybe root. It already works but is tighly coupled to launching sshd in a jail rather than any program.

is there any value in putting different groups of jails on different bridges? like to isolate jails from 1 user from jails of another user?

Are these the strongest GELI settings? geli init -e AES-XTS -l 256 -a HMAC/SHA512 -s 4k /dev/disk

yes

yay!

ForeverNoob[m]: pretty sure thats default though :p

also isn't AES-XTS vs AES-CBC still disputed? :p

XTS is for data at rest. CBC is for data in motion.

I will be holding a FOSS meetup in London on the 8th August, if you are interested please PM me for details!

I dont think there is any ML I can really put it on for freebsd

so the IRC will have to do

Would if I could!

Ugh, this is just _so_ annoying: forums.freebsd.org/threads/geom_eli-failed-to-authenticate.62401

Overwriting 4x 16TB drives with /dev/random is going to be a "fun" experiment in patience.

is there any value in putting different groups of jails on different bridges? like to isolate jails from 1 user from jails of another user?

thats not a jail issue, thats a network design issue

VNET jails for example would already have their own interface

dunno what any of that meant. the question is, put all jails for different people on the same bridge, or put jails for each person on their own bridge

?

ok got ssh into jail without public ip working using port forwarding

kerneldove: Might be simpler still to use ProxyJump.

kerneldove: Advantage: you're not exposing additional SSH ports.

That said, locking that down to just individual users and not letting them connect to the host itself or to other jails might be difficult.

well simpler isn't my #1 priority. dunno what proxyjump is but i got this working with just base fbsd functionality. pf, vnet jails, bridges

I am at a point where I am a hair distance from switching to FreeBSD in the future

I am noticing the political front in the linux community and it isn't for me. I like the non-woke distros but even they seem to be politica

I just refuse to participate in all of that

also I don't support Linus Torvalds woke agenda and his membership to the WEF

he is a globalist

I'm not for that either

I support Slackware's ideology

currently I am using Devuan but eventually Debian will sabotage that because they have the common liberal leftist globalist ideology

they will do it because it is their code base and Linus will put AI in the kernel like copilot and very soon Bill Gates and M$ will own linux

If you're going to be like this, openly, and unapologetically, to a significant subset of FreeBSD's users, just leave. Your behaviour does not appear conducive to the desired environment.

well I am saying this. FreeBSD is NOT linux

it is a separate OS

they are NOT the same thing

linux is a kernel

See points 2 and 3 of the topic's first section: be civilised, and respect others

FreeBSD is an OS

I will be civilized but I am not going to tolerate bullies of any type

that's just how it is

I don't have to

I don't see how praising "non-woke" and "anti-woke" is respecting others when "woke" is comprised of a single proposition: injustices can be combatted

seems rather unrelated to the OS either way...

well it is like this... I am not about politics. I am about what is actually true. I've spent the last 10 years doing research and I mean real research and not media research and not just believing things I am told.

I am not saying that everyone does this

I proffer that you're an agent-provocador from casa de Lunduke.

there are tons of people in Europe who are well aware and making the same decisions

yeah I dunno, if you like freebsd use it

no it isn't even that I support Lunduke. I think for myself

not a lemming

mewt, FreeBSD looks pretty good

but this is not really related to...well...the OS at all

lotta folks, mostly men, have told me that. 0% of them actually do think for themselves

it isn't

I thought I joined the offtopic chan

lol

anyway fair point

forewarned is forearmed, your behaviour is also not conducive to the desired enviroment over in -social

this and the "prove to me I should switch to your distro/OS" in what is nominally a support channel is tiring after a while

Reinhilde, I take your "forewarnings" as threats

Take them thus, if you like. I'm not here to implant a mode of thinking into you, you seem to have plenty of people like that for you already.

I am civil but once again not a serf

the point I make is very simple. People want privacy, they want control over their OS, they want freedom with what they do with their OS and then they submit to the people who do not want them to have it. The entire thing is about money

it should be FOSS

not politics

I like FreeBSD's design and license so far from what I am seeing

I notice that its community is not about politics ( or shouldn't be because they are not the linux community )

mewt, you don't have to prove to me why I should switch to FreeBSD. The behavior of many people are already doing that

I am enjoying Devuan but I see this as a temporary situation perhaps. It is a matter of time until that situation implodes on all debian based distros and I will be forced to either migrate to slackware, freebsd, or another bsd-like distro

*plonk: the sequel*

so anyway. I do apologize for this not being the offtopic channel and I will take note in the future

I will be leaving now as I am unwelcome even by the nonpolitical

unlike this nimrod, I am well aware of the fact that FOSS and communities around it are an explicitly political project.

(thankfully the nimrod left the channel.)

guess it really was just looking for reactions

it as in their behaviour I suppose?

yes

not very welcoming

It was very #freebsd-social

updating one of my ec2 instances from 15.0 to 15.1 and i'm at the step of updating the bootloader, however the freebsd-boot partition is only 16K and is not large enough for gptboot... any ideas? :/

it seems to have booted just fine into 15.1-RELEASE so.. idunno, nothingburger? heh

wcarson: They're legacy then?

what do you mean by legacy?

I find many people that speak at length about "doing their own research" end up being very Dunning-Kruger

spork_css: There's actual #freebsd-social for this, FWIW. I don't see you in there, but it's the Right Place.

I have more commentary for there if you join it.

just a throwback to our wanderer that left...

Yeah.

speaking of that, bouncers besides znc that people like, because this setup for an irc newb is both too GUI and not GUI enough, if that makes sense.

spork_css: Here, it's just irssi on a host that stays up and connected, and I ssh into it.

maybe I need to give myself a little shove with znc here and see if I can convince it to join -social with only sending commands to it via this irc app (Textual on macos, fork of LimeChat, FWIW).

Hm. ZNC has always seemed daunting here.

Maybe if you get it to work, you can write up what you did...?

spork_css: if you are connected to your znc from textual if you join a channel it should just save it and join next time as well

remember textual is actually connected to your znc and not just plain irc so what you send it, you send to znc

I've been configuring "join list on start" via znc, and thinking that's the only way to do it, but I just right-clicked on the Libera (via znc) network and there was a "list channels" - and I clicked -social and there I am. Man...

I setup znc years ago just for all the scrollback features plus the general urge to not connect directly from home and just never dug in to it.

mines setup to just pull up everything on my znc, but i've not changed a conf manually in over a decade by now, i'd have to re-learn it all to change anything

I've taken to leaving keywords in files I search (really a database, but...) for things I do periodically and forget. So I document them and then search as needed. Some of this makes it onto various wikis.