Openvpn – FreeBSD jail as gateway

freebsdgatewayjailopenvpn

I am trying to set up a jail that will serve as a default gateway for some of my external clients.

I have a VIMAGE jail that has a dedicated IP address in my local network which I want to use as a gateway for my clients.
The reason that I am doing it, if important, is that I want to run OpenVPN inside that jail so all my clients using the jail's IP as a gateway would go through VPN transparently.

When I ssh into the jail everything works: I can see the Internet, even when I switch on OpenVPN it works as expected.
However, it doesn't work as a default gateway for my clients: names don't get resolved, "no route to host", etc.

When I run tcpdump inside the jail I see the following:

20:53:23.263597 IP 192.168.1.6.54460 > syd15s01-in-f78.1e100.net.https: UDP, length 109
20:53:23.263636 IP 192.168.1.6.54460 > syd15s01-in-f78.1e100.net.https: UDP, length 109

where 192.168.1.6 is the client's IP so I assume that the client tries to reach the Internet via the jail, but nothing comes back.
I sometimes see some ICMP traffic too.

My ipfw config is:

# less /usr/local/etc/ipfw.rules
#!/bin/sh

EPAIR=$(/sbin/ifconfig -l | tr " " "\n" | /usr/bin/grep epair)
INNER="$(/sbin/ifconfig | grep " -->" | cut -d' ' -f2 | cut -d'.' -f1-3).0/24"
ipfw -q -f flush
ipfw -q nat 1 config if ${EPAIR}
ipfw -q add nat 1 all from ${INNER} to any via ${EPAIR}
ipfw -q add nat 1 all from any to any in via ${EPAIR}
# ipfw add check-state

TUN=$(/sbin/ifconfig -l | tr " " "\n" | /usr/bin/grep tun)
ifconfig ${TUN} name tun0

I assume some NAT is missing somewhere, but I don't really understand what's going on so any help is appreciated.

What should I do to allow my clients' traffic to go through the jail/vpn when they use jail's IP as a default gateway?

Best Answer

FreeBSD jails are basically a sort of lightweight virtualization, so it's best purpose - is to run some applications as containers. It surely has a network stack, but, comparing its functionality with a functionality of a host systems I'd say it's rather limited.

So chosing a jail as a container router seems to be a bad choice. What you should do - is to use multiple FIBs. By the way same approach applies to all the modern netwroked OSes - Linux, JunOS, Cisco IOS etc.

I would recommend to add net.fibs="4" into /boot/loader.conf, then reboot and use multiple routing tables. This way you can start your OpenVPN gateway in s separate FIB like setfib 1 /usr/local/bin ... whatever, then assign your clients traffic to it using setfib in ipfw or by directly assigning your clients interfaces to this FIB.

Related Topic