Mirrors/BastilleBSD_bastille
1
0
Fork 1
mirror of https://github.com/BastilleBSD/bastille.git synced 2025-12-12 01:49:51 +01:00
Code Issues Packages Projects Releases Wiki Activity

clarification to README on firewall settings

Browse Source
This commit is contained in:
Christer Edwards
2019-11-25 17:12:27 -07:00
parent f36744f2a0
commit 0a708c3dc7
2 changed files with 6 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
README.md
View File

@@ -97,12 +97,6 @@ ishmael ~ # sysrc ifconfig_lo1_name="bastille0"
ishmael ~ # service netif cloneup ishmael ~ # service netif cloneup
``` ```
Second, enable the firewall:
```shell
ishmael ~ # sysrc pf_enable="YES"
```
Create the firewall config, or merge as necessary. Create the firewall config, or merge as necessary.
/etc/pf.conf /etc/pf.conf
@@ -134,7 +128,8 @@ Note: if you have an existing firewall, the key lines for in/out traffic to
containers are: containers are:
``` ```
nat on $ext_if from bastille0:network to any -> ($ext_if) table <jails> persist
nat on $ext_if from <jails> to any -> ($ext_if)
## rdr example ## rdr example
## rdr pass inet proto tcp from any to any port {80, 443} -> 10.17.89.45 ## rdr pass inet proto tcp from any to any port {80, 443} -> 10.17.89.45
@@ -147,9 +142,10 @@ The `rdr pass ...` will redirect traffic from the host firewall on port X to
the ip of container Y. The example shown redirects web traffic (80 & 443) to the the ip of container Y. The example shown redirects web traffic (80 & 443) to the
container at `10.17.89.45`. container at `10.17.89.45`.
Finally, start up the firewall: Finally, enable and (re)start the firewall:
```shell ```shell
ishmael ~ # sysrc pf_enable="YES"
ishmael ~ # service pf restart ishmael ~ # service pf restart
``` ```

4
usr/local/share/bastille/start.sh
View File

@@ -51,10 +51,10 @@ TARGET="${1}"
shift shift
if [ "${TARGET}" = 'ALL' ]; then if [ "${TARGET}" = 'ALL' ]; then
JAILS=$(/usr/local/bin/bastille list jails) JAILS=$(bastille list jails)
fi fi
if [ "${TARGET}" != 'ALL' ]; then if [ "${TARGET}" != 'ALL' ]; then
JAILS=$(/usr/local/bin/bastille list jails | grep -w "${TARGET}") JAILS=$(bastille list jails | grep -w "${TARGET}")
fi fi
for _jail in ${JAILS}; do for _jail in ${JAILS}; do