I used your rules an worked is just that for an know reason if I
restart the vpn on the master host it stops working. also takes some
time for work.
any ideas ?
regards
On Apr 24, 2008, at 6:20 AM, Miroslav Lachman wrote:
Nicolas de Bari Embriz Garcia Rojas wrote:
In your example what values are for ext_addr_3, ext_if?
Server has external interface bge0 (connected to internet)
ext_if="bge0"
and 4 public IP addresses, $ext_addr_3 is one of them (dedicated to
this jail usage)
On Apr 22, 2008, at 4:09 PM, Miroslav Lachman wrote:
Nicolas de Bari Embriz Garcia Rojas wrote:
I have a ipsec/vpn on FreeBSD 6.3 from one master server to
another server the one has multiple jails. each jail has is own
public IP and i need to do something like this:
vpn point >----------------------< master server with jails
<------- > jail (75.76.78.80)
64.68.69.79/10.10.10.1 75.76.78.79/10.10.10.2
when doing a telnet to 10.10.10.2 80 from 10.10.10.1 I want
that the jail with ip 75.76.78.80 to respond, and also from
jail 75.76.78.80 been available to telnet the other vpn point
10.10.10.1.
I am trying to route trafic using PF but is not working for the
tunel only for the non encrypted trafic, example:
rdr on em1 proto tcp from any to any port 80 -> 75.76.78.80
but if i use the gif0 interface (the one for the tunnel) insted
of em1 does not work.
I am using slightly different setup. I have lo1 with IPs
172.16.1.0/24 for jails and public IPs are RDR / NATed from
public interface to local (jails).
I have one jail, where I need to connect throught OpenVPN on tap0
to the MSSQL database server and from the other and (MS Windows
Server) allow connection in to jailed MySQL database server.
Apache from this jail is publicly accessible on ports 80 and 443.
jail_addr_0="172.16.1.2"
jail_tcp_0_inports="{ 80, 443 }"
vpn_dtc_if="tap0"
vpn_dtc_addr_local="10.0.0.29"
vpn_dtc_addr_remote="10.0.0.10"
vpn_dtc_inports="{ 3306 }" # let incoming to local mysql
# outgoing connections
nat on $ext_if from $jail_addr_0 to !$jail_addr_0 -> $ext_addr_3
nat pass on $vpn_dtc_if from $jail_addr_0 to $vpn_dtc_addr_remote -
> $vpn_dtc_addr_local
# incomming connections
rdr on $ext_if proto tcp from any to $ext_addr_3 -> $jail_addr_0
rdr pass on $vpn_dtc_if inet proto tcp from any to
$vpn_dtc_addr_local port $vpn_dtc_inports -> $jail_addr_0
Miroslav Lachman
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-jail
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
