FreeBSD 12 Jail Host - Part 4 - Jails (2021)
Estimated reading time: Seal yourself in a dark room for a day or two.
We finally get to start some jails up!
All the parts in this series.
We're finally here! Let's create a jail and start it up. I've assumed you've downloaded the
12.2-RELEASE release for the jail, so if you're using something else make sure
# iocage create -r 12.2-RELEASE -n helloworld [...] // Tell iocage to use a virtual interface # iocage set vnet=on helloworld // Use the host system as the default router # iocage set defaultrouter=10.0.20.1 helloworld // Set the IP address to use for this jail, make sure it's unique # iocage set ip4_addr="vnet0|10.0.20.5/24" helloworld // Start the jail! # iocage start helloworld
Sometimes this will fail on first start for some reason with some vnet errors. (I think maybe it takes too long for the vnet interface to be created so iocage fails to configure it and bails?). If this fails with a vnet error, try again.
You should have a running jail now. We've got one more quick config step we need to perform with each jail we create, so let's do that now.
// Open a console in the jail # iocage console helloworld // Add some values to /etc/rc.conf jail# cat >> /etc/rc.conf firewall_enable="YES" firewall_type="OPEN" ^D jail# /etc/rc.d/ipfw restart
ipfw is already loaded and enabled in the kernel so is active in the jail, but not configured in the jail. This just configures an open firewall for the jail (you could also configure an actual firewall if you wanted).
At this point everything should be working. Test you can reach the host with something
ping 10.0.20.1, and test you can reach the internet
Unfortunately, if there are issues here debugging this is beyond the scope of this document. Sorry.
If everything's working at this point, then you're in good shape! In Part 5 we'll cover some handy commands and general architecture that may be useful.