So I am trying to install a Nextcloud instance inside a FreeBSD jail. The domain I have chosen is pointing at the host FreeBSD instance inside which I want to spin up a FreeBSD jail and in order to do that I have to assign my jail an IP address.
My question is how to provide a safe enough IP address so as to get up and running and also to get my domain name to point at the running jail instead of the host OS.
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
For using a internal private subnet series, you can stick to the common private IP ranges that start with 192. 172. and 10. [1] If you have enabled private IP for the droplet, just make sure that you choose a series different from the droplet private IP.
Next, the domain will still be pointing to host IP, what you can do is forward packets (using NAT) which arrive on socket - combination of host IP and TCP 80, to internal private IP plus any arbitrary port on where the service is listening in the jail(lets say 8000, or 8080, etc).
Request_from_Internet => host:80 => jailIP:xxxx
To configure the above you will need to work with PF and make the host act as a gateway, following blog has demonstrated basic concept(the last config example) on making NAT work, on top of this you will need to modify PF config to do port forwarding.
https://kgibran.wordpress.com/2016/01/10/internet-connectivity-to-jails-on-freebsd/
[1] https://en.wikipedia.org/wiki/Private_network#Private_IPv4_address_spaces
I set my jails up in a similar way, but I use a cloned loopback interface rather than an IP on an external interface. Since 127.0.0.0/8 (127.*.*.*) is reserved for the loopback address, you can use any address in that range (just don’t use the commonly used 127.0.0.1). I prefer to reserve 127.1.0.0/16 (127.1.*.*) for jails, so I could use the 3rd octet to logically/mentally group them if needed (e.g., by purpose or function). This approach “feels right” to me since it keeps local services on local IP addresses.
Add to /etc/rc.conf:
Bring up the cloned interface:
sudo service netif cloneup
Add to /etc/pf.conf:
Create and start your jail:
The rest (such as installing ezjail) should be typical setup/config.