We have ahost with the only external IP-address. We want to install many non-global zones to buld the system and to port packages or for other services. The crossbow helps us to solve this problem. Let’s look at the diagram of the host:
In this host we have a physical NIC atge which connected to an external hardware switch. A virtual interface ext0 (VNIC) was created over the physical NIC (for example, to make a tagged packets). Let’s see at the real example:
lenovo# dladm show-link LINK CLASS MTU STATE BRIDGE OVER atge0 phys 1500 up -- --
Create an extenal VNIC over the physical device:
lenovo# dladm create-vnic -l atge0 ext0
Let’s see the result:
lenovo# dladm show-link LINK CLASS MTU STATE BRIDGE OVER atge0 phys 1500 up -- -- ext0 vnic 1500 up -- atge0
Now configure the new VNIC as a regular network interface. Just create a file /etc/hostname.ext0 like this:
lenovo# cat /etc/hostname.ext0 192.168.0.3 netmask 255.255.255.0 broadcast + up
Create /etc/defaultrouter file and specify a default gateway like this:
lenovo cat /etc/defaultrouter 192.168.0.1
Now you can reconfigure the network, just restart the service network/physical:
lenovo# svcs network/physical STATE STIME FMRI disabled 9:48:02 svc:/network/physical:nwam online 9:48:11 svc:/network/physical:default lenovo# svcadm restart svc:/network/physical:default lenovo# svcs network/physical STATE STIME FMRI disabled 9:48:02 svc:/network/physical:nwam online 11:02:04 svc:/network/physical:default
You will see something like this:
lenovo# ifconfig
lo0: flags=2001000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL> mtu 8232 index 1
inet 127.0.0.1 netmask ff000000
ext0: flags=1004843<UP,BROADCAST,RUNNING,MULTICAST,DHCP,IPv4> mtu 1500 index 2
inet 192.168.0.3 netmask ffffff00 broadcast 192.168.0.255
ether 2:8:20:f9:ec:e5
lo0: flags=2002000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv6,VIRTUAL> mtu 8252 index 1
inet6 ::1/128
lenovo# netstat -rnf inet
Routing Table: IPv4
Destination Gateway Flags Ref Use Interface
-------------------- -------------------- ----- ----- ---------- ---------
default 192.168.0.1 UG 2 0 ext0
127.0.0.1 127.0.0.1 UH 2 28 lo0
192.168.0.0 192.168.0.3 U 4 60 ext0
Alternatively you can do it manually:
lenovo# ifconfig ext0 plumb lenovo# ifconfig ext0 inet 192.168.0.3/24 up lenovo# route add default 192.168.0.1
But… This is a temporary solution, it works until you reboot the system. You can use this method to access the system via ssh and then to configure the network permanently.
Now the global zone has configured partially, it means that we need second VNIC to do NAT for the non-global zones.
Configuring etherstub
Thechnically etherstub is a virtual software switch that does the same as a hardware switch. The differnce is the end point of the etherstub is a VNIC (instead of physical cable which connected to a physical NIC). So, to do a forward packets we need an interface which will receive packets from the non-global zones and forwards them to the external network (ext0). The VNIC will be first end point of the virtual switch (ethersub). Let’s create them in the host:
lenovo# dladm create-etherstub vsw0 lenovo# dladm create-vnic -l vsw0 int0 lenovo# dladm show-link LINK CLASS MTU STATE BRIDGE OVER atge0 phys 1500 up -- -- ext0 vnic 1500 up -- atge0 vsw0 etherstub 9000 up -- -- int0 vnic 9000 up -- vsw0
Line 1 creates a new etherstub named vsw0; line 2 creates a new VNIC over the switch and line 3 shows us the result. Now the interface int0 should be configured as we did it for ext0. I do it manually:
lenovo# ifconfig int0 plumb
lenovo# ifconfig int0 inet 10.68.0.1/24 up
lenovo# ifconfig int0
int0: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 9000 index 3
inet 10.68.0.1 netmask ffffff00 broadcast 10.68.0.255
ether 2:8:20:85:3d:bf
The interface int0 has created, but it will not forward anything outside. NAT and ip forwarding is not yet configured. Let’s configure one as it was described here:
lenovo# cat /etc/ipf/ipnat.conf map ext0 10.68.0.0/24 -> 0/32 proxy port ftp ftp/tcp map ext0 10.68.0.0/24 -> 0/32 portmap tcp/udp auto map ext0 10.68.0.0/24 -> 0/32
Enable ipfilter if it is still disabled:
lenovo# svcs ipfilter STATE STIME FMRI disabled 9:48:03 svc:/network/ipfilter:default lenovo# svcadm enable ipfilter lenovo# svcs ipfilter STATE STIME FMRI online 11:29:25 svc:/network/ipfilter:default
Examinging packets ip forwarding:
lenovo# routeadm
Configuration Current Current
Option Configuration System State
---------------------------------------------------------------
IPv4 routing disabled disabled
IPv6 routing disabled disabled
IPv4 forwarding disabled disabled
IPv6 forwarding disabled disabled
Routing services "route:default ripng:default"
Routing daemons:
STATE FMRI
disabled svc:/network/routing/ripng:default
online svc:/network/routing/ndp:default
disabled svc:/network/routing/legacy-routing:ipv4
disabled svc:/network/routing/legacy-routing:ipv6
disabled svc:/network/routing/rdisc:default
disabled svc:/network/routing/route:default
IPv4 forwarding is disabled (line 7); enable it:
lenovo# routeadm -u -e ipv4-forwarding
lenovo# routeadm
Configuration Current Current
Option Configuration System State
---------------------------------------------------------------
IPv4 routing disabled disabled
IPv6 routing disabled disabled
IPv4 forwarding enabled enabled
IPv6 forwarding disabled disabled
Routing services "route:default ripng:default"
Routing daemons:
STATE FMRI
disabled svc:/network/routing/ripng:default
online svc:/network/routing/ndp:default
disabled svc:/network/routing/legacy-routing:ipv4
disabled svc:/network/routing/legacy-routing:ipv6
disabled svc:/network/routing/rdisc:default
disabled svc:/network/routing/route:default
Now it is enabled, configure the first zone to test the result.