FreeBSD 12 – Common Problem 010 – Jail Cannot Reach External Network

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Services inside jail cannot fetch packages or reach APIs.

Environment & Reproduction

VNET jail starts normally but pings fail beyond gateway.

Root Cause Analysis

Bridge misconfiguration, missing NAT rules, or blocked forwarding in pf/ipfw.

Quick Triage

Check jail and host interfaces.

jls -v
ifconfig -a
service pf status

Step-by-Step Diagnosis

Inspect jail route table and host forwarding state.

jexec 1 netstat -rn
sysctl net.inet.ip.forwarding
pfctl -sn

Solution – Primary Fix

Enable forwarding, correct bridge config, and reload firewall NAT.

sysrc gateway_enable='YES'
sysrc cloned_interfaces+=' bridge0'
service netif restart && service pf reload

Solution – Alternative Approaches

Use non-VNET jails with shared host stack for simpler setups with fewer moving parts.

Verification & Acceptance Criteria

`jexec` ping and DNS tests pass; package installs succeed from inside jail.

Rollback Plan

Restore previous jail and pf configs from backup and restart networking.

Prevention & Hardening

Template jail networking, validate after every host firewall change, and monitor bridge health.

Related Errors & Cross-Refs

`Network is unreachable`, DNS timeout inside jail, no egress in packet captures.

Related tutorial: View the step-by-step tutorial for freebsd-12.

View all freebsd-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

`jail(8)`, FreeBSD jail handbook, `pf.conf(5)` NAT examples.