# Web Server in a Jail (ezjail) on VPS



## thomas_d (Jun 12, 2015)

Hi All,

I'd just like to confirm the correct approach to what I'm trying to achieve, here's what I've got:


VPS running FreeBSD 10, fresh install
A single NIC (re0), but with two public IP addresses, let's say 88.88.88.88 and 99.99.99.99 for purpose of thread, the provider has advised that both are /24 and their default route can go to the .1 of their respective network, though I've been able to work with both IP addresses just using a single default route e.g. 88.88.88.1, no need for 99.99.99.1
What I'm going for is an internet-facing web server in a jail let's say on the 99.99.99.99 IP address (the host is using the 88.88.88.88 address for network connectivity and any other services currently).

I've installed installed ezjail, ran `ezjail-admin install`, put ezjail_enable="YES" into /etc/rc.conf, created additional loopback lo1, started jails and then created jail with `ezjail-admin create webserver 'lo1|99.99.99.99'`, console into the jail, configure /etc/resolv.conf in the jail to point to public DNS severs, try to use pkg to install something e.g. apache24, it goes to fetch pkg and then just hangs at that 'Bootstrapping pkg' prompt.

Some advice on what's going on vs. what should be going on here would be much appreciated, apologies for cluelessness


----------



## junovitch@ (Jun 13, 2015)

What's happening is the request leaves the FreeBSD machine but your gateway cannot find 99.99.99.99 when it sends the reply back.  This is because of a layer 2 communication issue.  The 99.99.99.1 gateway will do an ARP request for 99.99.99.99 but the server will not reply back because that address is on the loopback.  The solution would be either to NAT to the "external" interface when you are using jails on the loopback or to simply create the jail on the external interface using: `ezjail-admin create webserver 're0|99.99.99.99'`


----------



## thomas_d (Jun 13, 2015)

Thank you! Got network connectivity in the jail now, did the ext_if|x.x.x.x method.

I notice my host now has both IP addresses against the one interface now, will the host now continue to use only its primary IP address for its own communications, or could this be a problem?


----------



## junovitch@ (Jun 13, 2015)

The IP address aliases will only get used when you explicitly ask to use them.  In the case of a jail bound to it, the jail will always use it.  There shouldn't be any issues.


----------

