From owner-FreeBSD-users-jp@jp.FreeBSD.org Tue Aug  7 11:51:16 2007
Received: (from daemon@localhost)
	by castle.jp.FreeBSD.org (8.11.6p2+3.4W/8.11.3) id l772pGu35265;
	Tue, 7 Aug 2007 11:51:16 +0900 (JST)
	(envelope-from owner-FreeBSD-users-jp@jp.FreeBSD.org)
Received: from iscan2.sys.hokudai.ac.jp (iscan2.sys.hokudai.ac.jp [133.87.1.97])
	by castle.jp.FreeBSD.org (8.11.6p2+3.4W/8.11.3) with ESMTP/inet id l772pBB35257
	for <FreeBSD-users-jp@jp.FreeBSD.org>; Tue, 7 Aug 2007 11:51:11 +0900 (JST)
	(envelope-from reo@iic.hokudai.ac.jp)
Received: from iscan2.sys.hokudai.ac.jp (localhost [127.0.0.1])
	by localhost.sys.hokudai.ac.jp (Postfix) with ESMTP id 587FD2845
	for <FreeBSD-users-jp@jp.FreeBSD.org>; Tue,  7 Aug 2007 11:51:03 +0900 (JST)
Received: from genki01.cc.hokudai.ac.jp (genki01.cc.hokudai.ac.jp [133.87.2.41])
	by iscan2.sys.hokudai.ac.jp (Postfix) with ESMTP id 385BD282C
	for <FreeBSD-users-jp@jp.FreeBSD.org>; Tue,  7 Aug 2007 11:51:03 +0900 (JST)
Received: from bareares.cc.hokudai.ac.jp (bareares.cc.hokudai.ac.jp [133.87.2.22])
	by genki01.cc.hokudai.ac.jp (Postfix) with ESMTP id E08F167656
	for <FreeBSD-users-jp@jp.FreeBSD.org>; Tue,  7 Aug 2007 11:50:55 +0900 (JST)
Message-ID: <86vebsys4w.wl%reo@iic.hokudai.ac.jp>
From: Hiroki Kashiwazaki <reo@iic.hokudai.ac.jp>
To: FreeBSD-users-jp@jp.FreeBSD.org
In-Reply-To: <FFC7D5787F9904hiroaki@sakuma.ne.jp>
References: <86tzri1l2f.wl%reo@iic.hokudai.ac.jp>
	<46B1CE94.40703@csg.is.titech.ac.jp>
	<FFC7D5787F9904hiroaki@sakuma.ne.jp>
User-Agent: Wanderlust/2.14.0 (Africa) SEMI/1.14.6
 (=?ISO-2022-JP?B?GyRCNF0yLBsoQg==?=) FLIM/1.14.8
 (=?ISO-2022-JP?B?GyRCO00+chsoQg==?=) APEL/10.7 Emacs/22.1 (i386-pc-freebsd)
 MULE/5.0 (=?ISO-2022-JP?B?GyRCOC1MWhsoQg==?=)
MIME-Version: 1.0 (generated by SEMI 1.14.6 - =?ISO-2022-JP?B?IhskQjRdGyhC?=
 =?ISO-2022-JP?B?GyRCMiwbKEIi?=)
Content-Type: text/plain; charset=ISO-2022-JP
Reply-To: FreeBSD-users-jp@jp.FreeBSD.org
Precedence: list
Date: Tue, 07 Aug 2007 11:50:55 +0900
X-Sequence: FreeBSD-users-jp 90900
Subject: [FreeBSD-users-jp 90900] Re: [Q] jail routing
Sender: owner-FreeBSD-users-jp@jp.FreeBSD.org
X-Originator: reo@iic.hokudai.ac.jp
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+060209

$BGp:j!wKL3$F;$G$9!%(B

$B$=$N8e!$$d$C$Q$jDL?.=PMh$J$/$J$C$?$j!$@_Dj$rEjF~$7$?$i(B OK $B$@$C$?$N$K(B
$B:F5/F0$7$?$i(B NG $B$H$+$$$m$$$m$"$j$^$7$F!$$h$&$d$/@0M}$9$k;v$,=PMh$^$7(B
$B$?!%8=:_$O0J2<$N$h$&$J9=@.$GF0$$$F$$$^$9!%(B

                host
            +------------+                    jail/www
       bge0 |     pf     |       bge0 alias +-----------+
 -----------+[port80 rdr]+------------------+80  apache +
 133.87.a.b |   [ nat ]  |     192.168.0.20 +-----------+
            +------------+

$B%]%$%s%H$@$C$?$N$O(B host $BB&$N(B pf $B$N@_Dj$G$7$?!%(Bnat $B$N@_Dj$G(B

  ext_if="bge0"
  table <private> const { 10/8, 172.16/12, 192.168/16 }
  nat on $ext_if from 192.168.0/24 to ! <private> -> ($ext_if)

$B$N$h$&$K5-=R$7$F$$$?$N$G$9$,!$(Bbge0 $B$K(B alias $B$,@_Dj$5$l$F$$$k>uBV$G$O(B
nat $B$N5,B'$,0J2<$N$h$&$KE83+$5$l$^$7$F!$(B

  % sudo pfctl -s nat
  nat on bge0 inet from 192.168.0.0/24 to ! <private> -> (bge0) round-robin

133.87.a.b $B$H(B 192.168.0.20 $B$,(B round-robin $B$GMxMQ$5$l$k;v$K$J$C$F$7$^(B
$B$C$FDL?.=PMh$J$$$H$$$&>uBV$K$J$C$?$N$G$O$J$$$+$H!%(B

$B$H$$$&$3$H$G!$(Bpf.conf $B$r(B

  ext_addr="133.87.a.b"
  nat on $ext_if from 192.168.0/24 to ! <private> -> $ext_addr

$B$K$7$^$7$F!$(B

  % sudo pfctl -s nat
  nat on bge0 inet from 192.168.0.0/24 to ! <private> -> 133.87.a.b

$B$H$J$C$F(B jail/www $BB&$+$i$NDL?.$,=PMh$k$h$&$K$J$j$^$7$?!%(B

$B%[%9%H$K%0%m!<%P%k%"%I%l%9!$(Bjail$BB&$,%W%i%$%Y!<%H$N;~$K(B NAT$B$r;H$o$J$1(B
$B$l$P$$$1$J$$;v$r$=$b$=$b3N?.=PMh$F$$$J$+$C$?>e$K!$(Bpf$B$G(B redirect $B$@$1(B
$B$O;H$C$F$$$?$N$G!$30It"*(B jail/www$B$X$N%"%/%;%9$,=PMh$F!$2?$G(B jail/www
$B"*30It$X$N%"%/%;%9$,=PMh$J$$$N$@$m$&$+$HXeG:$9$k;v$K$J$C$?$H$$$&%*%A(B
$B$G$9(B :-)

jail + NAT$B$N9=@.$G$^$H$^$C$?>pJs8;$,$J$+$C$?$N$G!$:#2s$N9=C[$r$I$3$+(B
$B$G$^$H$a$F$*$3$&$H;W$$$^$9!%$_$J$5$^$+$i$N>pJs$KB?<U!%(B

-- 
$BGp:j(B $BNi@8(B (Hiroki Kashiwazaki)@HUIST
Assistant Professor @ Graduate School of Information Science and
Technology, Hokkaido University
mailto:reo@iic.hokudai.ac.jp
Tel:+81-11-706-2056 (Office), +81-11-706-2998 (Takai Lab.)
