Network access from local zones on a Solaris 10 router

Question

I'm kind of stuck at an interesting problem.
I have a Solaris 10u6 system which is itself a router between a number of networks.
It has several dozen routes to different networks via different next-hop gateways,
just one of which is a default route to the ISP to internet.
I thought of setting up local zones to securely run infrastructure services (BIND,
Squid, Mail relay) on this machine, with only a single dedicated public IP address
(from our delegated address space) per such zone. Zones use a shared-IP stack
on one of the machine's VLAN interfaces (the LAN part with public IP addresses).
The problem is - since this machine is the gateway for the subnet used for the
local zones, they don't inherit any default route. The one default we have to the
ISP is on another interface's subnet.
[root@ns8 /]# netstat -rn | grep default
[root@ns8 /]# netstat -rn | wc -l
50
On a side note, these zones do inherit dozens of other routes (50 above) with
next-hop routers not on the local zone's subnet - so these are also not accessible.
I think such useless routes should also be filtered away - as "mismatching" default
routes are.
Due to all this the zone has no networking outside its subnet/mask: it doesn't
even try to send anything, since there is not a single route with a matching next
hop router, i.e.
[root@ns8 /]# traceroute -nI 194.87.0.50
traceroute to 194.87.0.50 (194.87.0.50), 30 hops max, 40 byte packets
1 xx.yy.zz.8 0.102 ms !H 0.032 ms !H 0.027 ms !H
To reiterate, this setup is different from that of the numerous replays of "How to
set up internet for zones with virtual IP addresses?"
That recipe suggests to add a fake router and maintain its ARP address to be
that of the real default gateway, and set up NAT to rewrite private IP addresses
to the global zone's public IP. While I've also used the recipe a number of times,
it does not seem feasible in this router's case - there are too many next-hop
routers (and learned with a dynamic routing protocol), not just one default-gw.
I can of course go back to running services in the global zone and binding them
to these dedicated public IP addresses via configuration files - and this works
since the global zone has access to any needed routers having IP addresses
in relevant subnets - but I hoped to secure the system a bit more and separate
routing from infrastructure tasks...
So the question is: how can I set up networking for local zones in this case
when they are running on a router? Is it possible?
Thanks,
//Jim

Answer 1

You can set the Airport Extreme in "Bridge" mode, and then it will just extend the existing subnet.
Airport Utility -> Airport Extreme -> Internet -> Connection Sharing -> Off (bridge mode)