Skip to end of metadata
Go to start of metadata

Introduction

This is a set of instructions to demonstrate how to set up a pair of zones where one of them is performing NAT for the other.

This could be generalized to a zone that performs NAT for a collection of zones/VMs, or other configurations as well.

Configure Etherstub

Configure Zones

Double NAT
My example happens to result in double NAT to reach the internet. My SmartOS machine is on a 192.168.0.1/24 network that is itself NATed to the Internet. The "firewall" zone is NATing the client zone from a 10.0.0.1/24 network onto that 192.168.0.1/24 network.
Things to note
Note the "allow_ip_spoofing" setting on the firewall zone NICs
  1. Example JSON for "Firewall" Zone
    firewall.json
  2. Example JSON for "Client" Zone/VM
    client.json

Configure NAT

  1. Example /etc/ipf/ipnat.conf
    /etc/ipf/ipnat.conf
  2. Turn on packet forwarding and ipfilter

References

  1. https://blogs.oracle.com/droux/entry/private_virtual_networks_for_solaris
  2. https://gist.github.com/2639064
  3. https://gist.github.com/e18d343cde4509afaa51
  4. https://www.google.com/?q=etherstub%20ipnat

Alternate Instructions for NAT on SmartOS

Unsupported bad ideas

/opt/custom/scripts/etherstubs
/opt/custom/smf/etherstubs.xml
Labels:
None
Enter labels to add to this page:
Please wait 
Looking for a label? Just start typing.
  1. Dec 21, 2012

    Without enabling route service, I am unable to make it work

  2. Apr 02, 2013

    I've followed this post but instead of having a dedicated zone I've configured the global zone as gateway/firewall: 

    http://blog.bgentil.fr/smartos-use-global-zone-as-gateway-for-guests.html

    Any comments/suggestions are welcome.