These intructions might work, but they need a bit of attention. I've been reading through ipf and smf documentation and have found a few ways to improve this process. When I have time I'll add that information here, until then, be sure to look into the ipf settings if you're having issues with routing. Good luck!
This is a modified version of sjorge's instructions for Single IP with NAT. Those instructions can be found here: https://docu.blackdot.be/snipets/solaris/smartos-nat
The primary difference is that this version does not rely on etherstubs for internal switching, but instead uses a vlan configuration. The benefits of this method over using etherstubs are:
- Project Fifo (project-fifo.net) can create vms and zones with vlans, but does not currently have etherstub support.
- Vlan switching is supposedly more efficient than creating an etherstub to handle switching. I have not tested this statement.
I've tested this setup on servers at both Kimsufi and SoYouStart (Both subsidiaries of OVH). I highly recommend these hosts. In other lab tests, this setup was used as the starting point for private vlan over vpn tunnel configurations.
Make sure to look at the net-setup shell script and to modify it to your settings. If you leave the current settings it will likely break things.
From the root shell of your smartos server.
mkdir -p /opt/custom/{smf,bin}
curl https://gist.githubusercontent.com/baetheus/5e1e5ab1eb68fae3490d/raw/net-setup > /opt/custom/bin/net-setup
chmod 770 /opt/custom/bin/net-setup
curl https://gist.githubusercontent.com/baetheus/5e1e5ab1eb68fae3490d/raw/net-setup.xml > /opt/custom/smf/net-setup.xml
The above commands will create new directories in opt and download a shell script that sets up the vlan and nat and an smf service manifest. At this point you can either run svccfg import /opt/custom/smf/net-setup.xml or reboot. Be sure to look at the two files associated in this gist and to change whatever you feel needs changing.
I've also included a sample zone config. To get started with that
mkdir /opt/zones
imgadm update
imgadm import d34c301e-10c3-11e4-9b79-5f67ca448df0
curl https://gist.githubusercontent.com/baetheus/5e1e5ab1eb68fae3490d/raw/sample-zone.json > /opt/zones/sample-zone.json
vmadm create -f /opt/zones/sample-zone.json
After running this you should be able to ssh to your sample zone like so: ssh -l root -p 2222 <external-ip>.
Good Luck!
Firewall: I've done a small amount of work locking down most of the basic networking holes with ipf, but I am by no means a network administrator. If you really wanted to lock down your stuff, here is where I'd start:
- Most internal vlan'd traffic should never be broadcast outside of the host. So vlans should be enough to segment internal hosts from external networks. But this is still not a great amount of protection.
- You may wish to block traffic between zones or to only allow certain outbound port traffic.
- Additionally, it would be more secure to add a second IP and to perform this routing inside of a zone plumbed to that ip, allowing only ssh traffic through the primary ip.
- Updated to net-setup to reflect a current working and stripped down ipf/ipnat config
- Removed insecure curl flags as gist.github.com ssl is now handled by most root cert chains.
- Update links to point to baetheus github user account instead of slashtact.
- Updated net-setup script to be a bit simpler.
- Reorganized README and fixed some minor mistakes.
- Updated curl links in README to always link to newest file revisions in gist.
- Fixed the net-setup script to actually include the example ssh tunnel for the example zone.
- Added some commentary on the firewall config, disclaimerish in nature.
Very usefull !
But I had to change
Setup Inbound NAT
echo "rdr $EXT_IF from any to any port = 2222 -> 10.0.0.20 port 2222 tcp" >> /etc/ipf/ipnat.conf
into
Setup Inbound NAT
echo "rdr $EXT_IF from any to any port = 2222 -> 10.0.0.20 port 22 tcp" >> /etc/ipf/ipnat.conf
And I had to comment ipf because neither ping nor ssh access worked with it.