jail.conf ignoring exec.fib?

[Arthur Chance]

On 14/08/2013 16:49, Karl Pielorz wrote:
>
>
> --On 14 August 2013 08:58 -0400 Fbsd8 <fbsd8 at a1poweruser.com> wrote:
>
>> The jail(8) man page lacks details about how to use exec.fib.
>>
>> It requires either a new kernel (with "options ROUTETABLES=2" or however
>> many you want), or a boot-time setting with "net.fibs=2" in
>> /boot/loader.conf (requiring a reboot).
>
> Yup, done that :)
>
>> setfib 1 route add default 198.192.64.21
>> creates routing table number 1 with that IP address.
>>
>> In this example exec.fib="1" would be coded.
>>
>> See setfib(8) and setfib(2) for details.
>
> Yeah, I do that as well - but 'netstat -r -n' from within the jail shows
> the systems default routing table.
>
> As opposed to 'setfib 1 netstat -r -n' (outside the jail) which shows
> fib either has no default gateway, or the one I set (which is right).
>
> Just within the jail, it only every shows it's using the systems default
> routing table :(
>
> Fib's work fine outside the jail (i.e. I can show them, set differing
> default gateways) - but no matter what I do, the 'exec.fib=' line in
> jail.conf seems to be ignored, when the jail is run up - it only ever
> sees the default routing table :(

What do you get in the jail from

sysctl net.fibs
sysctl net.my_fibnum

?

You should be getting 2 and 1 respectively. If you are, what happens in 
the jail when you ping an address that's covered by the fib 0 default 
route but that should be unroutable in the jail? You will need to enable 
allow.raw_sockets for the jail temporarily to try that.

-- 
In the dungeons of Mordor, Sauron bred Orcs with LOLcats to create a
new race of servants. Called Uruk-Oh-Hai in the Black Speech, they
were cruel and delighted in torturing spelling and grammar.

		_Lord of the Rings 2.0, the Web Edition_