Can I not lock down a jail from accessing the internet?

[guermantes]

Hi!
Getting ready to install my first plugin, I read a lot about it, and came across a thread chastising the software in question for by default, and in secret, accepting anonymous access from the entire internet (this was not necessarily in a Freenas context, so I don't know how relevant it was for Freenas, also it was addressed in an update, albeit not completely removed if I understand correctly).

However, it did get me thinking, as my trust in the Freenas team is much higher than my trust in random third-party devs whose software I may end up running in a jail.

So I figure I need to learn how to be in control over what can access the internet from a jail, and how to gauge if something is open for connections. I am learning Freenas/Freebsd from scratch, so one thing at a time; the first task I set for myself was to completely lock down a new jail so that nothing outbound is allowed (with a view to progressively opening up as needed).

I failed miserably at this task. I am able to disable DNS lookup so that I can't ping google.com, but if course this does not stop me from pinging their IP directly. I tried using the IPFW (firewall) by adding to my jail's /etc/rc.conf firewall_enable="YES" and firewall_type="closed" (also trient "client") but after restarting the jail this does nothing to prevent pinging out. And all I can find when searching online are people with the reverse problem, wanting to establish internet contact, not cutting it off.

How can I limit a jail to only communicate inside my LAN, but block it from going outside?

EDIT: is such a block not feasible to implement in the jail? Does it necessarily have to be done in the router?

 

[scrappy]

You should be able to isolate the jail IP with your home firewall/router, preventing it from making inbound/outbound connections from WAN. It all depends on your firewall/router's capabilities. However, your jail would still be able to communicate with other machines on the same LAN subnet.

 

[guermantes]

You should be able to isolate the jail IP with your home firewall/router, preventing it from making inbound/outbound connections from WAN. It all depends on your firewall/router's capabilities. However, your jail would still be able to communicate with other machines on the same LAN subnet.

That was actually my go-to solution, however my rather high-end Netgear router (SoHo, not business class regrettably) is letting through pings from the jail to google.com, whereas the same rule applied to my smartphone (connected wirelessly to the router) completely blocks the smartphone. (I have opened a ticket in their forums.)

So I got interested in trying to block at the level of the jail instead.

Perhaps it is not even possible?

 

[scrappy]

is letting through pings from the jail to google.com

It must have something to do with your router. Perhaps you need to reset all network states (reboot)? I use pfSense and had no problem blocking a single IP address inside my LAN from communicating to the outside world.

 

[guermantes]

It must have something to do with your router. Perhaps you need to reset all network states (reboot)? I use pfSense and had no problem blocking a single IP address inside my LAN from communicating to the outside world.

Actually, perhaps I am not seeing the situation correctly. It struck me that for some reason maybe ping was the culprit, so I tried to wget google.com from inside the jail (shell button from the jails page). And wget could not succeed to get through, and the router log showed that the jail IP was actually blocked.

Is ping google.com special, since it gets through and returns 0% packet loss?

 

[scrappy]

Ping is based on ICMP. Maybe your router is allowing it through?

 

[guermantes]

Ping is based on ICMP. Maybe your router is allowing it through?

Hmmm. Maybe that's it. I was blocking "All" protocols, not just TCP, UDP, etc... but when looking through all the available protocols that can be blocked with more granularity ICMP is not in the list. Must ask Netgear about this.

Thanks for your help!