FreeBSD FreeBSD Jails Networking and Jails

Example

FreeBSD jails can have fine grained networking configuration. By default, every jails use the same network configuration than host.

Removing network support

jail -c name="nonetwork" path="/path/to/your/jail" ip4=disable ip6=disable

Allowing only IPv4 networking

jail -c name="onlyipv4" path="/path/to/your/jail" ip4=inherit ip6=disable

Allowing only IPv6 networking

jail -c name="onlyipv6" path="/path/to/your/jail" ip4=disable ip6=inherit

Dedicated network stack (VNET)

VNET is recent feature allowing jail to have its own network stack. Doing this configuration need to add routing feature to the host. VIMAGE option is required in host kernel.

# starting our own jail with vnet
jail -c name="vnetjail" path="/path/to/your/jail" vnet=new

# we need a bridge...
ifconfig bridge0 create

# a pair of ethernet interface...
ifconfig epair0 create

# and interconnecting epair, jail and bridge
ifconfig epair0b vnet vnetjail
ifconfig bridge0 add epair0a
ifconfig bridge0 add ${your_external_interface}