OpenSolaris

Printable Version Enter a New Search
Bug ID 6338667
Synopsis Need ability to use NAT for non-global zones
State 10-Fix Delivered (Fix available in build)
Category:Subcategory network:ipfilter
Keywords fixed-by-crossbow | zones
Responsible Engineer Nicolas Droux
Reported Against
Duplicate Of
Introduced In
Commit to Fix snv_105
Fixed In snv_105
Release Fixed solaris_nevada(snv_105)
Related Bugs 6498311 , 6777213 , 4963372
Submit Date 19-October-2005
Last Update Date 17-December-2008
Description
non-global zones currently require a public IP address for each zone that uses the
network.  In some situations only one public IP address is available for the
system and users would like to run multiple network services inside non-global
zones, or simply to access the network from multiple zones.

It would be useful if the system could use NAT to let all zones share a single
public IP address.
brandz linux support is going to make this CR much higher visibility.
people will want to install linux zones and run application in them
that will need the ability to access the internet.  the workaround
for this bug is very complicated and leaves lots of room for user
error.  also the solution, once implemented, is very fragile wrt
changes in the local network configuration.

support for this functionality was asked for during brandz PSARC inception.
PSARC said that at brandz commitment time if brandz was not planning
to deliver this feature they would advice the PAC that this is an
issue which needs to be addressed.
Work Around
IPFilter can almost do this already with an ipnat(1M) rule or two but it
requires a lot of hacky setup with things like fake routing entries and fake 
ARP entries.
please visit http://blogs.sun.com/roller/page/ford?entry=using_nat_in_the_global
for a step-by-step description of how to apply this workaround for branded zones
on a laptop see:
	http://blogs.sun.com/roller/page/edp?entry=using_branded_zones_on_a

this is basically a re-factoring of the previously listed blog entry on this
same topic, but with steps added to configure a static network for the all zones
on the local host.
Comments
N/A