diff options
Diffstat (limited to 'files/usr/local/etc/jailctl.conf.freebsd_hypervisor')
| -rw-r--r-- | files/usr/local/etc/jailctl.conf.freebsd_hypervisor | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/files/usr/local/etc/jailctl.conf.freebsd_hypervisor b/files/usr/local/etc/jailctl.conf.freebsd_hypervisor new file mode 100644 index 0000000..02b6065 --- /dev/null +++ b/files/usr/local/etc/jailctl.conf.freebsd_hypervisor @@ -0,0 +1,29 @@ +#!/bin/sh + +JAIL_HOME='${hypervisor_jail_home}' +JAIL_DATASET='${hypervisor_jail_dataset}' +TRUNK_INTERFACE='${hypervisor_trunk_interface}' + +DEFAULT_DOMAIN='${domain}' +DEFAULT_VLAN='${hypervisor_default_vlan}' +DEFAULT_NETMASK='$(prefix2netmask "$hypervisor_default_prefix")' +DEFAULT_OS_QUOTA='${hypervisor_default_os_quota}' +DEFAULT_DATA_QUOTA='${hypervisor_default_data_quota}' + +ZFS_OPTS='${hypervisor_jail_default_zfs_opts}' + +DEFAULT_DEVFS_RULESET='5' +BPF_ENABLED_DEVFS_RULESET='${hypervisor_jail_bpf_ruleset}' + +DEFAULT_PF_CONF='egress = "jail0" + +set block-policy return +set skip on lo +scrub in on \$egress all fragment reassemble no-df + +antispoof quick for \$egress + +block all +pass out quick on \$egress inet +pass in quick on \$egress inet proto icmp all icmp-type { echoreq, unreach } +pass in quick on \$egress inet proto tcp to port ssh' |