Firewall in a zone to manage interface in another one

Question

Hi,
I would like to allow remote access to a zone in a system using a network interface (say hme0). On the other hand I want to place a firewall on the same interface, so that once in, users cannot connect to other IP addresses on the private network ( in the same switch) .
All of these can be done with a firewall (IPFilter or other) but then local users would have access to the system where the firewall is installed thus weakening security.
What I would like to achieve with zones is this: have the network interface accessible in one zone ( so that I can put ssh on it and allow users access) but control the interface with firewall rules that cannot be changed no matter what users do in the "ssh" zone (even if they are root in that zone)
I know that usually a part of the firewall is implemented as kernel modules and realize things might not be simple. Could this be achieved ? How ?
Thank you,
Vlad.

Answer 1

Solaris Express 06/04 (a.k.a. Solaris 10 Beta 4) has just been released; it includes the abovementioned pass/block feature. Here is the relevant excerpt from the documentation:
http://docs.sun.com/db/doc/817-1592/6mhahuopf?a=view#z.admin.ov-38
IP Traffic Between Zones on the Same Machine
Between two zones on the same machine, packet delivery is only allowed if there is a "matching route" for the destination and the zone in the forwarding table.
The matching information is implemented as follows:
o The source address for the packets is selected on the output interface specified by the matching route.
o By default, traffic is permitted between two zones that have addresses on the same subnet. The matching route in this case is the interface route for the subnet.
o If there is a default route for a given zone, where the gateway is on one of the zone's subnets, traffic from that zone to all other zones is allowed. The matching route in this case is the default route.
o If there is a matching route with the RTF_REJECT flag, packets trigger an ICMP unreachable message. If there is a matching route with the RTF_BLACKHOLE flag, packets are discarded.
The global zone administrator can use the route command options described in the following table to create routes with these flags:
Modifier Flag Description
-reject RTF_REJECT Emit an ICMP unreachable message when matched.
-blackhole RTF_BLACKHOLE Silently discard packets during updates.
For more information, see the route(1M) man page.