NAT Jail onto a secondary NIC?

[LennySh]

Hi all,

So I've figured out how to put jails onto a different VLAN (or second NIC) using VNET (with or without DHCP), and this works great! But now, I have a need to use NAT, but not on the primary NIC. I'd like to use NAT on a secondary NIC (it's on a different VLAN). I've tried setting the NAT interface under advanced jail properties, but I get an error message:

Code:

nat_interface can only be changed for defaults!

Has anyone been able to do this successfully? I mean, I can continue creating them on the other VLAN using VNET, but NAT would make more sense (to keep from using so many IP addresses).

Thoughts?

 

[TomWaller]

Hi all,

So I've figured out how to put jails onto a different VLAN (or second NIC) using VNET (with or without DHCP), and this works great! But now, I have a need to use NAT, but not on the primary NIC. I'd like to use NAT on a secondary NIC (it's on a different VLAN). I've tried setting the NAT interface under advanced jail properties, but I get an error message:

Code:

nat_interface can only be changed for defaults!

Has anyone been able to do this successfully? I mean, I can continue creating them on the other VLAN using VNET, but NAT would make more sense (to keep from using so many IP addresses).

Thoughts?

Sorry to revive an old thread - but did you ever get this working? I'm trying to do the same thing and hitting the same walls.

 

[Patrick M. Hausen]

NAT by definition uses the host's network stack. So you have no control over the interface - essentially there is none. It's just the host's link, routing table, etc. at work.

If you want control over the interface a jail uses, you must use VNET and bridging. Which works really well, even if the setup might be a bit unintuitive and not well documented.

 

[TomWaller]

NAT by definition uses the host's network stack. So you have no control over the interface - essentially there is none. It's just the host's link, routing table, etc. at work.

If you want control over the interface a jail uses, you must use VNET and bridging. Which works really well, even if the setup might be a bit unintuitive and not well documented.

Thanks for getting back to me :)

Sure, the VNET and bridging works fine so far. The issue I have is I want to be able to host my jails on the same IP address, instead of getting either DHCP addresses or seperate static addresses. I was hoping NAT may allow me to do that, but it doesn't appear so, or I'm doing something very wrong.

 

[TomWaller]

Thanks for getting back to me :)

Sure, the VNET and bridging works fine so far. The issue I have is I want to be able to host my jails on the same IP address, instead of getting either DHCP addresses or seperate static addresses. I was hoping NAT may allow me to do that, but it doesn't appear so, or I'm doing something very wrong.

Oh - I should probably mention this is a seperate IP, on a seperate VLAN, not the management IP.

 

[DrZombi]

Hi all,

I have the exact same problem except that the root needs are not the same. For me, I've just put on a script to export my jail regularly as a backup, but each time the cron runs, I receive an error stating that NAT interface is not defined and thus igb0 will be used.
It works, but I don't want to receive this annoying email each morning and I don't want to disable the stderr going to an email since it can be useful in case of a real error happening.

So I wanted to configure a NAT interface in the jail but whatever I enter in the field never works. I keep getting this :

And since I'm not very familiar with FreeBSD and its networking, I'm a bit lost because official documentation does not give any example of what this field acceptable values.

Can someone help me please ?

 

[Patrick M. Hausen]

I generally recommend not to use NAT for jails. If you use VNET and bridging you are free to assign your jail to the interface you prefer.

 

[DrZombi]

I generally recommend not to use NAT for jails. If you use VNET and bridging you are free to assign your jail to the interface you prefer.

Hi Patrick,

This is why I precised that I'm not familiar with FreeBSD and networking but thanks for your answer, I'll have a look in this direction :)