New series: FreeBSD Foundationals

[larvitz@burningboard.net]

New series: FreeBSD Foundationals

Part 1 is about Jails - specifically VNET Jails. What epair interfaces actually are (virtual ethernet cables), how bridges tie them together, why the host is basically a router for your jails, and what devfs rulesets control.

Covers the full lifecycle from jail.conf through pf firewalling with NAT/RDR for IPv4 and direct routing for IPv6. Plus the gotchas that'll cost you hours if nobody warns you.

Not a beginner tutorial, hardcore details. The useful middle.

https://blog.hofstede.it/freebsd-foundationals-jails-from-chroot-on-steroids-to-full-virtual-networks/

#Unix #FreeBSD #Networking #Jails #DevOps #SelfHosting #Sysadmin

[subnetspider@mastodon.bsd.cafe]

@Larvitz VNET Jails really are one of FreeBSD's greatest features.

And while I do not have need for, you could also give a jail of of your FreeBSD hosts physical interfaces, skipping epair and bridge interfaces entirely.

Netgraph VNET Jails are also pretty neat, though I find working with ng_* interfaces a bit too complicated, so I usually stick with epair.

[larvitz@burningboard.net]

@subnetspider Yep, classic jails. I mentioned them briefly and in the comparisson table of the article

[subnetspider@mastodon.bsd.cafe]

@Larvitz Sorry, what I meant is that you can give a VNET jail one of your hosts physical interface (e.g. igb0) which disappears from the host once the VNET jail is started. This also works with VLAN interfaces (e.g. em0.60) and so on (I did read the article). ^^

*Depending on the interface (or rather, it's driver), those physical interfaces can sometimes get "stuck" after the VNET jail is stopped, not getting released back to the host properly.

[eurodrigolira@mastodon.social]

@Larvitz

Great, thank you!

[mrcool@social.tchncs.de]

@Larvitz This just helped me set up my first vnet jail. Thank you.

[larvitz@burningboard.net]

@mrcool Glad it worked