SOLVED FreeNAS 11, iocage - no bpf(4) in jail

[Patrick M. Hausen]

Hi, guys,

yesterday I tried to replace my DHCP/DNS bhyve VM with an iocage managed jail. I could not get iocage to provide /dev/bpf inside the jail. I did

Code:

iocage set bpf=on <jail>

, though.

Missing feature? Bug? Did I miss anything?

Thanks,
Patrick

 

[scrappy]

Shared IP Jails (the default) rely on your host system's firewall unless you have set your jail to use vnet which provides the jail with its own network stack. You could then configure a firewall from within the jail. Iocage will not do this for you as far as I know.

 

[Patrick M. Hausen]

1. I did configure a vnet jail, of course.
2. You are still missing the point. This is not a firewall but a devfs issue.

Patrick

 

[dlavigne]

Did you set bpf to on? Looks like the default is to be off: https://www.freebsd.org/cgi/man.cgi?query=iocage&sektion=8.

 

[Patrick M. Hausen]

What did I write in my initial post?

Kind regards,
Patrick

 

[dlavigne]

Fair enough

It may be a bug then. Please create a report at bugs.freenas.org that includes your debug (System -> Advanced -> Save Debug) and post your issue number here.

 

[Patrick M. Hausen]

https://bugs.freenas.org/issues/25169

Kind regards
Patrick

 

[Patrick M. Hausen]

@Brandon Schneider: thanks for the update, for everyone else to read here:

"The new iocage port does not have DHCP support yet, this won't be a feature in 0.9.9, but may land in 1.0. In the meantime I suggest creating your own devfs ruleset and setting that on the jail"

Which raises the next question: how can I persistently create my own devfs ruleset in FreeNAS? I could use a post-init script that appends to /etc/defvs.rules, for example. Is there a more canonical way?

Thanks!
Patrick

 

[Patrick M. Hausen]

This as a post-init script does the trick:

Code:

#! /bin/sh

cat >>/etc/devfs.rules <<EOF
# Add /dev/bpf to jail devices to run dhcpd
#
[devfsrules_bpfjail=10]
add include $devfsrules_jail
add path 'bpf*' unhide
EOF

combined with

Code:

iocage set  devfs_ruleset=10 <jail>

Take care,
Patrick

 

[alexisph]

As of iocage 1.0, the following is needed to run DHCP client/server in the jail:

Code:

sudo iocage set bpf=yes dhcp=on devfs_ruleset=5 JAILNAME