> > I have 3 sparse zones with the IPs 192.168.0.10, 192.168.0.20, and
> > 192.168.0.30.
> > I would like to use NAT and IPF to, for example, forward port 2222
> > requests from the public IP to 22 on 192.168.0.10 which is bound as
> > elxl:1; and 3333 to 192.168.0.20, bound to elxl0:2, etc.

> 1. The global zone must also have an address in your private subnet.

> 2. You have to create a fake default route out of your private subnet
>    so the zones can access the internet

> I use names for the following examples:

> fakerouter              dummy IP address of a fake default router in
>                         your subnet
> global                  IP address of global zone in your subnet
> zone1                   IP address of one non-global zone

> They could look line

> 172.16.1.254            fakerouter
> 172.16.1.1              global
> 172.16.1.101            zone1

> The network interface in the following examples will be "bge0". Set
> netmask as required in /etc/inet/netmasks

> (1) setup the global zone. The script should start before starting zones.
>     You can either define a service with proper dependencies or put the
>     script in /etc/rc2.d (zones will start as milestone:multi-user-server
>     which is equivalent to run level 3)

>         #!/sbin/sh
>         iface="bge0"
>         globalname="global"
>         fakerouter="fakerouter"

>         routerip=`netstat -rn | awk '/default/ { print $2 }'`
>         ping $routerip >/dev/null 2>&1
>         routermac=`netstat -pn | nawk '$2 == "'$routerip'" { print $NF }'`
>         ifconfig $iface addif $globalname deprecated netmask + broadcast + up
>         route add default $fakerouter
>         arp -s $fakerouter $routermac
>         /usr/sbin/ipf -y

> This script will get the MAC address of the default router, create a static
> arp entry with the MAC address of the router to "fakerouter" IP address
> and sets a default router from the private net to this router. Then it
> will reload ipfilter rules.

> Change variable names as required.

> You will see two default routes in your global zones, but don't worry - that's
> Ok.

> (2) setup ipfilter/ipnat

> ipf.conf should contain at least the following rules so private addresses
> won't leak out:

>         block out quick on bge0 from any to 10.0.0.0/8
>         block out quick on bge0 from any to 172.16.0.0/12
>         block out quick on bge0 from any to 192.168.0.0/16

>         block in quick on bge0 from 10.0.0.0/8 to any
>         block in quick on bge0 from 172.16.0.0/12 to any
>         block in quick on bge0 from 192.168.0.0/16 to any

> In ipnat.conf you can use the usual redirect rules. Say, zone1 contains a
> mail server:

>         rdr bge0 0/0 port smtp -> zone1 port smtp tcp age 120
>         rdr bge0 0/0 port submission -> zone1 port submission tcp age 120

> And for outgoing traffic

>         map bge0 172.16.0.0/12 -> 0 age 120

> ("age 120" is (was?) needed because of a ipfilter bug introduced in S10U4)

> --
> Daniel