Choose a jail network model

Synopsis #

A jail network is an architecture decision, not a creation flag. The host always remains responsible for the physical interface, routing, and firewall. The main choice is whether the jail shares the host network stack or receives an independent VNET stack.

For a first internet-facing service, a private address with host NAT and explicit port redirection is usually the easiest model to audit. Use VNET only when the workload needs its own interfaces, routing table, DHCP, WireGuard interface, or packet-filtering context.

Choose from the requirements #

Network isolation and filesystem isolation are different controls. VNET does not make a jail equivalent to a virtual machine, and a private address does not prevent a compromised jail from using whatever outbound traffic PF permits.

Prefer private NAT for narrow services #

The procedure in Create a first jail with Bastille creates a conventional jail with a private address on bastille0. Bastille adds the address to its PF table so that the host can translate outbound traffic.

This arrangement has a useful default property: a service is not reachable through the host’s public address merely because it starts listening in the jail. Exposure requires an explicit mapping. Publish a Bastille service through PF adds that mapping after verifying the listener and firewall path.

Choose an RFC 1918 range that does not overlap any LAN, VPN, cloud, or routed remote network. An overlap can make replies follow the wrong route even when the PF rules are correct.

Use a shared interface for a simple LAN address #

A classic jail can use an unused address from a subnet already attached to a host interface. Bastille adds that address as an alias. The jail shares the host network stack but is restricted to its configured addresses.

This is simpler than VNET when the service merely needs its own LAN address. It also removes the protection provided by an unadvertised private network: LAN peers can reach the address if the firewall permits them. Confirm address ownership, ARP behavior, and upstream routing before creation.

Use VNET for a separate network stack #

VNET gives the jail its own interfaces, addresses, routes, and network stack. Bastille’s -V mode creates and manages a bridge and epair interfaces. Its -B mode attaches epairs to a bridge that the host already manages.

VNET is justified for requirements such as:

• running DHCP or routing software inside the jail;
• terminating a VPN on an interface owned by the jail;
• using multiple interfaces or routing tables;
• observing or filtering traffic at a jail-specific interface boundary.

It also creates more failure points. Record the host-side epair, jail-side interface, bridge members, default route, and the interface on which PF filters packets. Do not copy bridge filtering sysctls from another installation without first determining where filtering is intended to occur.

Record the design before creation #

For every jail, record:

1. The network model and the reason it is required.
2. The host interface or bridge involved.
3. The jail addresses, prefix lengths, and default route.
4. The DNS resolver source.
5. The host PF table, NAT rule, and inbound mappings.
6. Whether an address is reachable from the LAN, a VPN, or the public Internet.

After creation, compare the record with actual state:

$ ifconfig -a
$ netstat -rn
# bastille list jail
# pfctl -sr
# pfctl -sn

When the path fails, follow Diagnose DNS, routing, and firewall paths from the jail outward rather than changing several layers at once.

Primary references #

• Bastille networking
• FreeBSD Handbook: Jails and Containers
• jail(8)
• vnet(9)
• bridge(4)