FreeBSD 13 – VNET jail has no outbound connectivity via bridge – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Services inside VNET jail cannot reach upstream hosts, causing application outages.

Environment & Reproduction

Appears after host reboot or epair recreation with stale bridge membership.

jls -v
ifconfig bridge0
jexec appjail ifconfig -a

Root Cause Analysis

Bridge missing epair member or host NAT/routing is not forwarding traffic.

Quick Triage

Check bridge members, jail interface state, and forwarding sysctl.

ifconfig bridge0
ifconfig epair0a
sysctl net.inet.ip.forwarding

Step-by-Step Diagnosis

Trace packet movement from jail interface to bridge and outbound NIC.

tcpdump -ni epair0a -c 30
tcpdump -ni bridge0 -c 30
jexec appjail ping -c 3 8.8.8.8

Solution – Primary Fix

Reattach epair interfaces to bridge and restore host forwarding/NAT.

ifconfig bridge0 addm epair0a up
sysrc gateway_enable="YES"
service routing restart

Solution – Alternative Approaches

Use shared-IP jail model for simpler network topology when isolation requirements allow.

sysrc cloned_interfaces=""
service netif restart

Verification & Acceptance Criteria

Jail resolves DNS and reaches external networks with stable latency.

jexec appjail ping -c 3 1.1.1.1
jexec appjail drill freebsd.org
netstat -rn

Rollback Plan

Revert bridge topology to prior known-good mapping from backup config.

cp -a /etc/rc.conf.vnet.bak /etc/rc.conf
service netif restart

Prevention & Hardening

Automate bridge member validation and startup ordering checks.

ifconfig bridge0 | grep member
service jail onestatus

Related Errors & Cross-Refs

Often overlaps with pf NAT misconfiguration and default route omissions inside jails.

Related tutorial: View the step-by-step tutorial for FreeBSD 13.

View all FreeBSD 13 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

FreeBSD VNET jail networking and bridge operations references.