Jails on FreeBSD 9.0

[Herbert J. Skuhra]

On Tue, Jul 17, 2012 at 11:46 AM, Herbert J. Skuhra <h.skuhra at gmail.com> wrote:

> With pf:
>
> I see the packets going out/coming in on fxp0 but somehow the jail
> does not "see" them.

Running 'nc 173.194.35.177 80"

'pfctl -ss' shows:

all tcp xx.xxx.xx.xxx:54724 (192.168.1.1:30177) -> 173.194.35.177:80
    ESTABLISHED:SYN_SENT

tcpdump on pflog0 shows :

16:32:28.489495 rule 11..16777216/0(match): pass out on fxp0:
xx.xxx.xx.xxx.54724 > 173.194.35.177.80: Flags [S], seq 3219071188,
win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 13114581 ecr
0], length 0
16:32:28.499804 rule 0..16777216/0(match): nat in on fxp0:
173.194.35.177.80 > 192.168.1.1.30177: Flags [S.], seq 3667423105, ack
3219071189, win 14180, options [mss 1430,sackOK,TS val 1463073042 ecr
13114581,nop,wscale 6], length 0
16:32:28.893420 rule 0..16777216/0(match): nat in on fxp0:
173.194.35.177.80 > 192.168.1.1.30177: Flags [S.], seq 3667423105, ack
3219071189, win 14180, options [mss 1430,sackOK,TS val 1463073436 ecr
13114581,nop,wscale 6], length 0
16:32:29.494073 rule 0..16777216/0(match): nat in on fxp0:
173.194.35.177.80 > 192.168.1.1.30177: Flags [S.], seq 3667423105, ack
3219071189, win 14180, options [mss 1430,sackOK,TS val 1463074036 ecr
13114581,nop,wscale 6], length 0
16:32:30.695744 rule 0..16777216/0(match): nat in on fxp0:
173.194.35.177.80 > 192.168.1.1.30177: Flags [S.], seq 3667423105, ack
3219071189, win 14180, options [mss 1430,sackOK,TS val 1463075237 ecr
13114581,nop,wscale 6], length 0
16:32:31.489462 rule 0..16777216/0(match): nat out on fxp0:
xx.xxx.xx.xxx.54724 > 173.194.35.177.80: Flags [S], seq 3219071188,
win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 13117581 ecr
0], length 0
16:32:31.500226 rule 0..16777216/0(match): nat in on fxp0:
173.194.35.177.80 > 192.168.1.1.30177: Flags [S.], seq 3667423105, ack
3219071189, win 14180, options [mss 1430,sackOK,TS val 1463076040 ecr
13114581,nop,wscale 6], length 0
16:32:33.098531 rule 0..16777216/0(match): nat in on fxp0:
173.194.35.177.80 > 192.168.1.1.30177: Flags [S.], seq 3667423105, ack
3219071189, win 14180, options [mss 1430,sackOK,TS val 1463077639 ecr
13114581,nop,wscale 6], length 0
16:32:34.689460 rule 0..16777216/0(match): nat out on fxp0:
xx.xxx.xx.xxx.54724 > 173.194.35.177.80: Flags [S], seq 3219071188,
win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 13120781 ecr
0], length 0
16:32:34.699834 rule 0..16777216/0(match): nat in on fxp0:
173.194.35.177.80 > 192.168.1.1.30177: Flags [S.], seq 3667423105, ack
3219071189, win 14180, options [mss 1430,sackOK,TS val 1463079239 ecr
13114581,nop,wscale 6], length 0
16:32:37.889462 rule 0..16777216/0(match): nat out on fxp0:
xx.xxx.xx.xxx.54724 > 173.194.35.177.80: Flags [S], seq 3219071188,
win 65535, options [mss 1460,sackOK,eol], length 0
16:32:37.899648 rule 0..16777216/0(match): nat in on fxp0:
173.194.35.177.80 > 192.168.1.1.30177: Flags [S.], seq 3667423105, ack
3219071189, win 14180, options [mss 1430,sackOK,TS val 1463082437 ecr
13114581,nop,wscale 6], length 0
16:32:37.906102 rule 0..16777216/0(match): nat in on fxp0:
173.194.35.177.80 > 192.168.1.1.30177: Flags [S.], seq 3667423105, ack
3219071189, win 14180, options [mss 1430,sackOK,TS val 1463082444 ecr
13114581,nop,wscale 6], length 0
16:32:41.089474 rule 0..16777216/0(match): nat out on fxp0:
xx.xxx.xx.xxx.54724 > 173.194.35.177.80: Flags [S], seq 3219071188,
win 65535, options [mss 1460,sackOK,eol], length 0
16:32:41.100282 rule 0..16777216/0(match): nat in on fxp0:
173.194.35.177.80 > 192.168.1.1.30177: Flags [S.], seq 3667423105, ack
3219071189, win 14180, options [mss 1430,sackOK,TS val 1463085636 ecr
13114581,nop,wscale 6], length 0
16:32:44.289462 rule 0..16777216/0(match): nat out on fxp0:
xx.xxx.xx.xxx.54724 > 173.194.35.177.80: Flags [S], seq 3219071188,
win 65535, options [mss 1460,sackOK,eol], length 0
16:32:44.300060 rule 0..16777216/0(match): nat in on fxp0:
173.194.35.177.80 > 192.168.1.1.30177: Flags [S.], seq 3667423105, ack
3219071189, win 14180, options [mss 1430,sackOK,TS val 1463088834 ecr
13114581,nop,wscale 6], length 0

What's wrong?

In the meantime I've found kern/164271.

Regards,
Herbert