How to configure NAT with etherstub

We have a host with the only external IP-address. We want to install many non-global zones to build the system and to port packages or for other services. The crossbow helps us to solve this problem. Let’s look at the diagram of the host:

Open

In this host we have a physical NIC atge0 which connected to an external hardware switch. A virtual interface ext0 (VNIC) was created over the physical NIC (for example, to make a tagged packets). Let’s see at the real example:

Create an extenal VNIC over the physical device:

Let’s see the result:

Now configure the new VNIC as a regular network interface. Just create a file /etc/hostname.ext0 like this:

Create /etc/defaultrouter file and specify a default gateway like this:

Now you can reconfigure the network, just restart the service network/physical:

You will see something like this:

Alternatively you can do it manually:

But… This is a temporary solution, it works until you reboot the system. You can use this method to access the system via ssh and then to configure the network permanently.

Now the global zone has configured partially, it means that we need second VNIC to do NAT for the non-global zones.

Configuring etherstub

Thechnically etherstub is a virtual software switch that does the same as a hardware switch. The differnce is the end point of the etherstub is a VNIC (instead of physical cable which connected to a physical NIC). So, to do a forward packets we need an interface which will receive packets from the non-global zones and forwards them to the external network (ext0). The VNIC will be first end point of the virtual switch (ethersub). Let’s create them in the host:

Line 1 creates a new etherstub named vsw0; line 2 creates a new VNIC over the switch and line 3 shows us the result. Now the interface int0 should be configured as we did it for ext0. I do it manually:

The interface int0 has created, but it will not forward anything outside. NAT and ip forwarding are not yet configured. Let’s configure one as it was described here :

Enable ipfilter if it is still disabled:

Examinging packets ip forwarding:

IPv4 forwarding is disabled (line 7); enable it:

Now it is enabled, configure the first zone to test the result. Here we do not explain step by step configuring of a non-global zone, it was described here , just do it:

The only I would like to comment here is the lines 10-13.

In line 10 we specified a physical VNIC which will be created at zone boot time over the global nic vsw0 (line 11), instead of a global nic we specified an etherstub (virtual switch), in line 12 we assign an IP-address from our internal private network. As we remember from the previous step, we configured first IP-address on the interface int0 to forward the traffic from our zones. In line 13 we use the int0 as the default gateway. In line 20 I specified an IP-address of name server (external for the host, it could be google’s public addresses: 8.8.8.8, 8.8.4.4).

Install and boot the zone:

Boot it:

After the zone booted we can login into its console:

Test the network:

Ping the name server we specified in the zone configuration:

Ping google’s DNS (as the external resource):

So, the NAT and the IP forwarding are working perfectly!

Let’s install the second zone (zone02) using the same template:

Install and boot it as the zone01:

Login in the second zone:

Examining the network:

And now ping the first zone:

Yes, we can communicate the neighbour zones.

Try to setup the zone03 from the figure as an exercise to understand every step in this article.