no internet connection inside jail...?

[bgobs]

im using ezjail and freebsd 6.2

the jail is working, bat has no internet.

# cd /usr/ports/databases/mysql51-server/ && make install clean
===> Vulnerability check disabled, database not found

You may use the following build options:

WITH_CHARSET=charset Define the primary built-in charset (latin1).
...
WITH_NDB=yes Enable support for NDB Cluster.

=> mysql-5.1.12-beta.tar.gz doesn't seem to exist in /var/ports/distfiles/.
=> Attempting to fetch from ftp://ftp.easynet.be/mysql/Downloads/MySQL-5.1/.
fetch: ftp://ftp.easynet.be/mysql/Downloads...2-beta.tar.gz: No address record
=> Attempting to fetch from ftp://ftp.fi.muni.cz/pub/mysql/Downloads/MySQL-5.1/.
fetch: ftp://ftp.fi.muni.cz/pub/mysql/Downl...2-beta.tar.gz: No address record
...
=> Attempting to fetch from ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/.
fetch: ftp://ftp.FreeBSD.org/pub/FreeBSD/po...2-beta.tar.gz: No address record
=> Couldn't fetch it - please try to retrieve this
=> port manually into /var/ports/distfiles/ and try again.
*** Error code 1

Stop in /basejail/usr/ports/databases/mysql51-server.

my external IP is different class - 77.X.X.X.
for my jail i'm using 192.168.1.7 (it exist as alias in ifconfig).
is this a problem?

i have /usr/jails/myJail/etc/resolv.conf but it doesnt solve the problem.

do i need to add smth in /etc/host or jail's /etc/host?

inside the jail sysinstall says "no interfaces available".

any ideas?

[anomie]

The "no address record" error seems to point to DNS issues. Could you post (from inside the jail) the contents of /etc/resolv.conf?

[cajunman4life]

Try putting

nameserver 208.67.222.222
nameserver 208.67.220.220

In your /etc/resolv.conf (inside the jail) and see what happens.

The above addresses are for OpenDNS's DNS servers.

[Weaseal]

Try some other DNS servers... 4.2.2.1 and 4.2.2.4 are other well-known public ones.

I have never been able to resolve with OpenDNS's.

[bgobs]

resolv.conf inside the jail

domain my-domain.com
nameserver 77.X.X.X

now

nameserver 4.2.2.1
nameserver 4.2.2.4
nameserver 208.67.222.222
nameserver 208.67.220.220

and now /usr/local/etc/rc.d/ezjail.sh restart takes a lot of time

i test it with 2 masks:

ifconfig rl0 alias 192.168.1.7 netmask 0xffffffff

and

ifconfig rl0 alias 192.168.1.7 netmask 0xffffff00

but, still no luck.


*** edit

just to test i start jail with my IP (77.X.X.X) and DNS (77.X.X.1) and everything was ok (if this helps)

[Weaseal]

Originally Posted by bgobs

just to test i start jail with my IP (77.X.X.X) and DNS (77.X.X.1) and everything was ok (if this helps)

Everything was okay meaning that it works? Sounds like your ISP might be blocking DNS requests outside of their network (perhaps to reduce bandwidth usage). You'll need to talk to them about that.

[bgobs]

Originally Posted by Weaseal

Everything was okay meaning that it works? Sounds like your ISP might be blocking DNS requests outside of their network (perhaps to reduce bandwidth usage). You'll need to talk to them about that.

yes, it works. i test it by istalling midnight commander inside the jail:
# jail /usr/jails/test test 77.X.X.X /bin/sh
then
# cd ... && make install
and voila - everything was ok

i'll try calling my ISP.



*** edit

i call them.
well... im using LAN. my ISP have plans for different number of PC's. now im using their plan for 2 pc's. they told me that i must buy their next plan (for 5 pc's) if i want more IP's.
so, my qestion is: is there a way to run jails without buying new plan?
and of course they must not see that, because they are the best ISP in my town and i dont want to be in their black list i prefer to buy next plan if there is a risk my ISP to think that i'm "shering" internet or whatever they will think about it.

[anomie]

Originally Posted by bgobs

so, my qestion is: is there a way to run jails without buying new plan?

Well, you're not going to get two publicly routable IP addresses without their "new plan".

And somehow I completely missed this from your first post:

Originally Posted by bgobs

my external IP is different class - 77.X.X.X.
for my jail i'm using 192.168.1.7 (it exist as alias in ifconfig).

Your choices that I can think of are 1) use some form of NAT, and run the host and jail(s) with RFC 1918 address space; 2) buy the ISP's new plan; 3) live with the jail having no internet access, and install ports/packages using the host system (mount nullfs).

This decision is going to depend on what you're trying to do...

[bgobs]

Originally Posted by anomie

This decision is going to depend on what you're trying to do...

i want to run web (apache, php, mysql) and mail (dovecot, postfix, spamassassin, clamav) server.

is it posible with different jails and no internet access inside them? may be they can use localhost? (when im writing this and then reading it... it sound like realy stupid question but may be i'm too lame)

if it posible somehow can you guide me what/where to RTFM?

if it's not or it's hard to do and requires a lot of knowledge - ignore it. i'll buy next plan.

[anomie]

Originally Posted by bgobs

i want to run web (apache, php, mysql) and mail (dovecot, postfix, spamassassin, clamav) server.

is it posible with different jails and no internet access inside them?

Who should those services be accessible to? Just the host system? Or the outside world?

[bgobs]

Originally Posted by anomie

Who should those services be accessible to? Just the host system? Or the outside world?

outside.

for my personal usage i have windows with XAMPP.


*** edit:
i was testing...
i start two jails on one ip - its ok

it seems that there is no problems using jails with one ip.
i must use different ports for my services

any bad comments about this solution?

[cajunman4life]

I'd recommend getting a router that does NAT for you, that way you can have one publicly routable IP address, but literally thousands (depending on the router you get and what "fake" network it uses) of internal IP addresses for your machines only.

You can then set up in the routher that requests on port 80 go to 192.168.0.43 but requests for port 25 go to 192.168.0.87. Or however your network is set up.

And as far as the ISP is concerned, you have one publicly facing machine (the router). No need to pay them extra for you having more than one computer, because they don't provide anything extra to you (except it sounds like they may be giving you an extra IP which would most likely be overkill for you).