VLANing between jails not segmenting traffic

[Michael Gmelin]

On Thu, 2 Nov 2017 13:19:31 +0100
Marko Cupać <marko.cupac at mimar.rs> wrote:

> On Mon, 30 Oct 2017 22:46:35 +0100
> Michael Gmelin <grembo at freebsd.org> wrote:
> 
> > You can use fibs with net.add_addr_allfibs=0 to get separate routing
> > tables (comes with its own set of complications though).  
> 
> I hoped to go this way, but the fact that host (in fib0) replies to
> icmp requests destined to jail with raw_sockets disabled (in fib 1)
> via host's default gateway, making really wierd routing situation.

Shouldn't you be able to fix this using a pf pass rule with rtable?

Maybe you can share more of your setup, quite curious.

-m

> 
> Had to go back to separate physical hosts for now. Will check VIMAGE.



-- 
Michael Gmelin