Solaris 10 Zones and networking..

Question

My machine has only one NIC card (rtls0) and also only one public ipv4 IP. I am at the moment unable to get more than one public IP. I've also created a few zones on the machine which I have assigned an internal IP. Now, I can connect (say SSH for example) internally to these zones just fine using their internal IP from the global zone. However, obviously the outside world would not be able to do so. So I decided to simply use the built in firewall/nat tech in Solaris in order to port forward certain ports to internal zones. (Like say set up port 2223 on the global level to forward ssh to one of my created zones' ssh) I looked up and down everywhere with the ipf and ipv4 port forwarding down to enabling it via routeadm and also setting the value of /dev/tcp ip_forwarding to 1. Then when I add the following rule to ipnat:
rdr rtls0 PUBLIC_IP/32 port 2223 -> 192.168.1.2 port 22 tcp
It still has zero effect on the forwarding. It fails to forward, and nothing I've done works. I'm on my last leg here with this issue. Am I doing something wrong with ipfilter or is there a better way to go about doing this with Solaris Zones? (I mean surely there must be an easier way to create self contained zones with applications that still run services without having to resort to assigning it its own IP, no?) Any help is appreciated, thanks.

Answer 1

First thing to check is if your zone can access the global zone (try pinging). If this isn't the case you probably need to setup a routing entry allowing the non-global zone some access.
For example, say the global is 10.0.0.1 and the non-global 192.168.0.1 on eri0 you'd use something like:
route add 10.0.0.1 192.168.0.1 -iface
This tells your non-global zone that it can reach the global zone through the eri0 interface. Ofcourse you can also expand this to networks and such.
Another very important factor to keep in mind when dealing with internet is trying to access it from the non-global zone (as a test). Your ipnat.conf entry should be enough, my guess for to the reason for not routing the data is a non-static arp entry of your internet gateway. Now, this is a mere guess but if you have a default route in your routing table setup for Internet access (netstat -rn) make sure that the host to which the default route is pointing also has a static arp entry (man arp). If this is indeed the case you may also need to setup a routing entry as mentioned above to allow your zone access to this remote gateway.
After that things should work as usual. Hope this helps.