# FreeBSD 10.0 jail



## Ignatz (May 21, 2014)

Hello, everyone!

Is there any way to create a jail with two netwotk interfaces in it?


----------



## Crest (May 22, 2014)

Your question is imprecise. If you're asking whether it is possible to assign a single jail IP addresses from multiple interfaces in jail.conf then the answer is yes. The syntax is to use = for the first assignment and += for the other assignments.


----------



## Ignatz (Jun 5, 2014)

I'm sorry for the lack of info, I'll try to be more precise.

jail.conf

```
foo {
        path = /jail/foo;
        host.hostname = foo;
        ip4.addr = 192.168.1.5, 10.10.10.5;
        mount.devfs;
        devfs_ruleset = 4;
        exec.start = "/bin/sh /etc/rc";
        exec.stop = "/bin/sh /etc/rc.shutdown";
        jid = 3;
        allow.raw_sockets=1;
}
```

So if I ping from jail to machine *bar*  with address 10.10.10.6 -> I'm getting this on bar



```
[root@host1 ~]# tcpdump -i bge0 | grep ICMP
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bge0, link-type EN10MB (Ethernet), capture size 65535 bytes
15:06:21.242854 IP 192.168.1.5 > 10.10.10.6: ICMP echo request, id 63319, seq 7, length 64
15:06:22.243944 IP 192.168.1.5 > 10.10.10.6: ICMP echo request, id 63319, seq 8, length 64
15:06:23.245003 IP 192.168.1.5 > 10.10.10.6: ICMP echo request, id 63319, seq 9, length 64
```


```
[root@src4 ~]# tcpdump -i bge1 | grep ICMP
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bge1, link-type EN10MB (Ethernet), capture size 65535 bytes
15:10:21.492931 IP 10.10.10.6 > 192.168.1.5: ICMP echo reply, id 63319, seq 247, length 64
15:10:22.493902 IP 10.10.10.6 > 192.168.1.5: ICMP echo reply, id 63319, seq 248, length 64
```


It looks like traffic on this machine  from jail1 if going in through bge0 interface and going out through bge1. I suppose it happens because all traffic from jail going out from the first address in ip4.addr string 
Can I somehow change that jail behavior?


----------



## asteriskRoss (Jun 9, 2014)

Hi @Ignatz, it should be possible to do what you want.  It sounds like at present, the alias IP addresses are being associated with the wrong interface.  You should be able to see the aliases associated with each interface by running `ipconfig -a` in the host.  Can you post the output?

The man page for jail(8) describes how to associate IP aliases with an interface when the jails start:


> Jail	Parameters
> [...]
> Other parameters may have	more than one value,
> specified as a comma-separated list or with ``+=''	in the configuration
> ...



So I believe the following (untested) configuration adapted from the /etc/jail.conf you posted should do what you need, assuming I've guessed your desired interface/IP address associations correctly:

```
foo {
        path = "/jail/foo";
        host.hostname = "foo";
        ip4.addr = "bge0|192.168.1.5";
        ip4.addr += "bge1|10.10.10.5";
        mount.devfs;
        devfs_ruleset = "4";
        exec.start = "/bin/sh /etc/rc";
        exec.stop = "/bin/sh /etc/rc.shutdown";
        jid = "3";
        allow.raw_sockets = "1";
}
```


----------

