Plugins tied to a seperate NIC/subnet

[emergant]

I've built a freenas box around a Supermicro board with 4 nics and plan to migrate most of what currently runs on a Proxmox VE linux box to this machine.

File sharing including timemachine backup
Owncloud
Plexmediaserver (maybe play with mediabrowser)

I have an OpenWRT based router which provides two SSIDs to two seperate networks on 2 vlans and a managed switch supporting both vlans. I can break out the vlans to seperate untagged networks at the router or switch as I don't think you can assign vlans to jails?

The purpose of the network split is that untrusted devices can access media functions but not other facilities. So plexmediaserver is available on the less trusted network but not owncloud for example

I can't figure out how to do this using the Freenas UI. I don't want to hack things on a lower level because I'm looking for an easy life come upgrade time :) and I'm more of a linux than a BSD guy.

According to a bug I filed, theres an error in the 9.3 docs. Whilst you can assign a specific nic to a jail, you must do this using the traditional jail model and uncheck VIMAGE. I've no idea how to reconfigure a VIMAGE plugin to a traditional jail and I'm hoping someone can give me some pointers?

Heres a link to my bug. I'm taking this to the forum because I'm hoping someone has this working.

https://bugs.freenas.org/issues/7128

I think I need to edit the plexmediaserver jail, uncheck VIMAGE and provide an ip4 static ip, and setup bridges and or aliases? I've plaid around here a bit but don't understand IPv4 aliases or IPv4 bridge aliases:which I think I need to configure

ifconfig shows that I have nics igb2 and igb3 with IPs on the correct networks 192.168.1.0 and 192.168.2.0

I also have a bridge:

bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
ether 02:80:85:45:ab:00
nd6 options=1<PERFORMNUD>
id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
member: epair1a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 10 priority 128 path cost 2000
member: epair0a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 9 priority 128 path cost 2000
member: igb3 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 4 priority 128 path cost 20000

and these :
epair0a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 02:61:81:00:09:0a
nd6 options=1<PERFORMNUD>
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active

epair1a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 02:d1:b5:00:0a:0a
nd6 options=1<PERFORMNUD>
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active
epair1b: flags=8842<BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 02:14:86:00:0a:0b
nd6 options=9<PERFORMNUD,IFDISABLED>
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active

Appreciate any help

Mark

 

[emergant]

Okay, I got it working partially as follows:

Edit the jail in advanced mode specifying no VIMAGE or NAT. Enter an IPv4 address and a Netmask of 255.255.255.255 (I'm not using DHCP) and select the relevant NIC from the dropdown. I also needed to go to System>General and change the WebGUI to be available on the IP of my main NIC only Don't want the Freenas UI available from the jails IP Make sure that the IP address for the secondary NIC is blank with no DHCP also.

The thing is I can access my cifs shares via the jails IP which is clearly wrong. Not sure how to ensure that the shares are bound to one NIC only?

Mark

 

[emergant]

Okay, its all good now found the option to specify which IP CIFS bind too