Yes, "container" as in Zone... whatever Sun is calling the virtual
computers within the server this week... If ipfilter will only work with
a physical interface, then it won't work for my situation it sounds
like. Just for fun and my own education, I may load up a test server and
see what happens if I try to bind ipfilter to a virtual nic, but I'm not
holding out a lot of hope.
Thanks for the info,
Karl
Phil Dibowitz wrote:
Darren Reed wrote:
In some email I received from Phil Dibowitz, sie wrote:
Karl Fosburg wrote:
Regarding S10 and ipfilter... Does anyone know if we could run
ipfilter within a Solaris container? Basically, we'd like to NAT
from one (inside) private IP domain to many different (outside) IP
domains, some of which will overlap.
I believe so. The solaris inside of a container will work just like
normal solaris (depending on how you configure it).
I missed the original Karl wrote, for some reason, but if he means
"container" as in Zone, then the answer is NO. The answer is the
same if he's referring to the security containers.
The present system only allows for packet filtering on _physical_
interfaces, or more precisely, for IP packets entering or leaving
the system.
As I understand it, with N1 Grid containers, you can allocate an
entire physical interface to a Zone, and it has access to the physical
device.
But this is all based on technical presentations I've seen. I've not
actually played with it.
