Hacker News Reader

Comment by idatum | Hacker News Reader

I have a VNET jail for remote access to my home lab. This takes an extra NIC I wasn't using anyway. It has been solid running on FreeBSD 13.2.

This jail allows me to lock things down to minimal access to other services I need remotely, such as an SSH tunnel to Home Assistant.

I run my FreeBSD server mainly for ZFS. Adding a jail for remote access adds to the usefulness that hardware.

View on HN

An extra NIC is fine if you've got slots, but you can also do an if_bridge in the main host, add the real nic and half of an if_epair; then move the other half to the vnet jail.

Potentially a non-vnet jail with the ipv4/ipv6 options set may also be an option. I used to use jails with those settings to squeeze multiple environments into a single host at Yahoo.

I use only if_epair and then pf to NAT it to the external world. I’ve only had issues with if_bridge, where I would either be able to make connections between jail and the external world, but not between host and jail or vice versa (between host and jail fine, but not between jail and external world). And it would act really flaky, like getting one ping response, followed by silence. pf is a lot simpler and more reliable.

> I used to use jails with those settings to squeeze multiple environments into a single host at Yahoo.

Greetings! Miss the ole days at the ‘Hoo when we were all FBSD based!

Can you elaborate on what this looks like?

jail.conf:

ssh { exec.start = "/bin/sh /etc/rc"; exec.stop = "/bin/sh /etc/rc.shutdown"; exec.clean; mount.devfs; path = "/var/jail/ssh"; host.hostname = "ssh"; vnet; vnet.interface += "em0"; }

It's IPv6 only, so this is key in rc.conf: rtsold_enable="YES"

OpenBSD PF based router does the rest. IPv6 simplifies things here.

PF on FreeBSD isn't the most ideal, sure, but I can limit local access on inet6.

For SSH tunnel, it's straight forward.

FWIW VNET is not inherently IPv6 only. I'm using it in an IPv4 only context just fine.

Reply on news.ycombinator.com