Sharing a ip between two jails

[orjan-]

I have two jails running, one of them a webserver with access from WAN with ip 10.0.0.200/255.255.255.0 on vnet0:bridge0 and the default 127.0.0.1 lo0 interface. The other jail is running a service that has a unprotected http interface, this jail is on 10.0.0.201/255.255.255.0 on vnet0:bridge0 and the default 127.0.0.1 lo0 interface. Both jail have default router set to 10.0.0.1.
I would like to create a shared internal ip between these two jails and bind the unprotected http service to this internal ip and set up a http proxy from the webserver jail to the jail with the unprotected http service in order to get access to it from the WAN and to add https and authentication.
The freenas interface is on 10.0.0.100/255.255.255.0 on em0.

I know how to set up the proxy in the webserver, but i have no clue about ip interfaces on the system and adding them in iocage. Can someone help me with the commands needed to set up an internal ip?

 

[sretalla]

Have a look at this.

Reverse Proxy using Caddy (with optional automatic TLS)

I've thought for a while that it would be nice to set up a reverse proxy in a jail to give easier access to many of the other apps I have installed in jails, without having to remember their port numbers. And it would be nice for the sake of security if it did TLS termination as well...

www.ixsystems.com

A reverse proxy will handle all that, you will tell it the two different jail IPs and direct the router port forwarding to the reverse proxy IP.

 

[orjan-]

Have a look at this.

Reverse Proxy using Caddy (with optional automatic TLS)

I've thought for a while that it would be nice to set up a reverse proxy in a jail to give easier access to many of the other apps I have installed in jails, without having to remember their port numbers. And it would be nice for the sake of security if it did TLS termination as well...

www.ixsystems.com

A reverse proxy will handle all that, you will tell it the two different jail IPs and direct the router port forwarding to the reverse proxy IP.

I dont want to bind the unprotected http service to the LAN ip of the jail. That's why i want to the create a extra internal(loopback?) ip shared between the jails instead.

 

[sretalla]

I don't want to bind the unprotected http service to the LAN IP of the jail. That's why i want to the create a extra internal(loopback?) IP shared between the jails instead.

It sounds like you don't understand what a reverse proxy is doing (it does what you are asking for).

Is it that you want to do it twice?

Do you really distrust your LAN so much?
If so, maybe you want to look at the second post and rest of the thread here: https://www.ixsystems.com/community/threads/ipfw-loading-rules-in-jail.26962/
With a firewall enabled in the jail, you could only allow the reverse proxy IP to talk to the services in the jails on the required port(s).