Protecting a jail with a firewall

[cbx]

Hey everybody,

Freenas version 9.3 running on a HP Proliant N40L

Ive been using freenas for the past couple of years and so far it has been friggin awesome. Just recently I setup a jail running transmission which I have been using to download torrents (all legal ones of course!). I try to be very security-concious so I've configured my ddwrt gateway's firewall to block all ports because I'm not running any servers on my lan that I want to be available to the internet. I've also setup openvpn on my transmission jail to anonymize my torrents. The problem with this is that I'm solely relying on my VPN provider to block connection requests to my jail because the vpn bypasses my router's firewall, which poses an obvious security threat.

I've tried to setup a pf firewall on the jail with no success by editing my rc.conf to include the following lines:

Code:

pf_enable="YES"
pf_rules="/etc/pf.conf"
pflog_enable="YES"
pflog_logfile="/var/log/pflog"

In addition to this I created a pf.conf with a couple of default PASS rules but when I start the jail, pf doesn't start and there is no pflog interface when I run ifconfig. If I try to manually start pf with "kldload pf", I get "operation not permitted". I can't use sudo within the jail. I can't execute "pkg install pf" (pkg not found). At this stage I'm a bit lost as to where to go. Can somebody please point me in the right direction to help me get a firewall running inside the jail?

Basically I just want to setup a firewall and create a few basic rules to block all requests to the jail through tun0 (which is the vpn).

Thanks in advance :)

P.S. Sorry if i'm blabbering on at all, it's like 3am here and I've been up all night trying to figure this out... time for bed now I think :p

 

[SweetAndLow]

This is a strange thing to do and i doubt you will get anyone to respond. Can you just configured OpenVPN to not accept inbound connections in your jail?

 

[Nick2253]

This will not work, because jails don't get their own pf. By design, the host is supposed to control the network interfaces of the jails.

Installing OpenVPN inside of the same jail as transmission is the wrong way to do it. You should create a separate jail for OpenVPN, and then use the pf of FreeNAS to link the two together with appropriate filtering.

EDIT: This thread has more information on setting up OpenVPN properly: https://forums.freenas.org/index.ph...-6-with-access-to-remote-hosts-via-nat.22873/ Once you get it set up, you will then be on your own to configure the firewall rules appropriately. I would recommend referring to FreeBSD forums for help in doing this.

 

[DearestDreamer]

This will not work, because jails don't get their own pf. By design, the host is supposed to control the network interfaces of the jails.

Installing OpenVPN inside of the same jail as transmission is the wrong way to do it. You should create a separate jail for OpenVPN, and then use the pf of FreeNAS to link the two together with appropriate filtering

I'm trying to achieve this and I have successfully set up an OpenVPN client standard jail (192.168.1.100) and a deluge standard jail (192.168.1.101), but I can't figure out what kind of ipfw rules I have to add on my FreeNAS host machine which sees both these jails. Could you bump me into the right direction? I'd basically need something like this but I've been looking for hours and can't seem to get it to work:

ssh on my freenas server (192.168.1.50) and add rules:
01000 allow ip 192.168.1.100 to 192.168.1.101 from any to any
02000 deny ip 192.168.1.101 to any

I'm really not sure how to link the two jails..