00:01:56 for a jail that doesn't have a public ip, and only has a private lan ip, i guess i don't set a default gateway address? 00:07:55 or do i make the jail host be the default gateway or? how do i know pls? 00:19:22 depends if the jail has its own network stack 00:32:27 ya it's vnet 00:33:58 on the host check, jls -N 00:34:10 and jexec nameofjail ifconfig 00:34:25 ok you're just telling me commands but WHY 00:34:28 like what's the point 00:35:12 it either shares the hosts network or has its own 00:35:28 i said it has vnet 00:37:06 my bad that you said vnet already, so the only thing left is what the jails epair is pluggeed into the host thats what decides the next hop 00:37:29 is your nic a physical member? 00:42:19 don't even know what your'e asking or why. i'm back at the conceptual stage. if a jail is only intended to have a private lan ip, it doesn't get a default gateway address configured right? 00:42:38 kinda rude for someone trying to help your vague question 00:43:09 agree to disagree 00:43:32 good luck 00:44:21 ya helping ppl usually involves actually reading their question and understanding what their goal is instead of just blurting shit out 00:44:56 ok, well you'll find what you're looking for eventully. need to remember that some people do this for a living. 00:44:57 later 00:50:35 for the record, public vs private has nothing to do with it. What matters is whether traffic actually leaves the subnet and pkg, dns, ntp all do so yes it gets a default gateway and since it's 'VNET' with its own routing table you set it in the jail ' defaultrouter="yourlanrouter", same address every other box on that lan uses. 00:51:15 the epair/bridge stuff i was asking about only matters if your setup isn't the simple bridged case. Which I was trying to establish... 00:53:57 jail uses host time so ntp is irrelevant afaik. pkg for the jail is also ran by the host. and there's no dns. this is all so that jails can be on a private lan, doing specific work in a service-oriented architecture, behind another jail that does have a public ip and proxies to the others on the private lan 00:58:43 yeah if the private jails only ever talk to the proxy jail on the same subnet then no default route needed at all. Now we know that nothing leaves the subnet. Also pkg -j runs pkg inside the jail, so with vnet it uses the jail network and dies with no route. use pkg -r /path/to/your/jail/ so the host fetches. If the proxy jail is on a diff subnet then the privat ones they do need a route back to it. static or default either way. 01:00:22 Oh, I need to think about that. I've set up NAT so I could reach out from my jails, but maybe I don't actually need it. 01:05:59 pkg -r 01:06:24 proxy jail has 2 epair nics. 1 with public ip and 1 with ip on private lan 01:07:06 mason ya i'm converting my jails to not need internet by default by using freebsd-update -j and pkg -r 01:07:31 nice nice 01:07:58 I've said this in here before, but my latest move is off of epair/vnet and onto old-fashioned networking for jails. I'm loving it. 01:09:00 I think the next move for me would have to be off of jails entirely and back to chroots. :P 01:09:03 why and how? 01:09:52 Why? Simplicity. How? I spin up a new lo interface for them to sit on, with a private subnet, and then just port forward in as needed, and NAT out, although clearly the NAT is optional. 01:10:35 ya that's cool. i'll still keep using vnet except for service jails that are just app containment but i see the value 02:17:16 so i got a jail host and vnet jail with no public ip, only private ip. i want to ssh to jail host port 555 and have it redirect to the jail's private ip and port 22. on jail host i made pf rule `rdr pass on pubif proto tcp from any to any port 555 -> 192.168.0.5 port 22` then it says blocking from bridge0 to 192.168.0.5, so i add pass on bridge, 02:17:17 reload pf, now i ssh to jail host port 555 but nothing happens. what i'm doing wrong pls?