Solaris11 e redes complexas: sem roteamento

Question

Eu tenho um servidor com o solaris11.4, dois nics Eu uso para testes, aprendizado, etc. Eu tenho uma rede, a clássica 192.168.0.0/24 Mas para máquinas virtuais eu quero usar outra rede 10.2.0.0/24 Então eu sigo este procedimento

a) Primeiro eu criei uma bridge com net1 e net0, caso contrário net1 start "disconnected"

dladm create-bridge -l net0 -l net1 bridge1

b) Então eu configuro o ipv4 addr para net1

ipadm create-ip net1
ipadm create-addr -T static -a 10.2.0.1 net1

ipadm e dladm não reportam erros

c) Então eu corro no servidor solaris11 isc-dhcp e isc-dns Tudo funciona bem, testado, posso resolver hostnames externos e dhcp endereço de avaliação

d) Eu instalei o VirtualBox, máquinas com ponto de rede em ponte para net1

e) Eu configurei o firewall com nat

#Vars
ext_if="net0"
int_if="net1"
virt_if="vnic0"
ext_net="192.168.0.0/24"
int_net="10.2.0.0/24"
webports="{443, 80}"

##  make IP reassembly work
set reassemble yes no-df

## ignore loopback traffic
set skip on lo0

# block everything unless told otherwise
# and send TCP-RST/ICMP unreachable
# for every packet which gets blocked
block return in log all
pass out all

# accept incoming SSH connections
pass in proto tcp to any port 2122

# accept dhcp connections
pass in proto udp to any port 67:69
pass in proto tcp to any port 67:69

# accept dns connections
pass in proto udp to any port 53
pass in proto tcp to any port 53

# accept webeservers SSH connections
pass in proto tcp to $ext_if port 8888:8889
pass in proto tcp to $ext_if port $webports

# accept icmp
pass in proto icmp all

## allow all connections initiated from this system,
## including DHCP requests
pass out

#nat
pass out on net0 from $int_net  to any nat-to (net0)

f) Com roteadm eu tenho habilitado roteamento e encaminhamento de ip.

Agora o "resultado"

Eu posso pingar 10.2.0.0/24 de 192.168.0.0/24 OK Eu posso pingar 192.168.0.0/24 de 10.2.0.0/24 vm está OK Eu posso pingar endereço externo (google.de, etc) de 10.2.0.0/24 vm está OK Não consigo me conectar com nenhum protocolo da vm's !! NÃO ESTÁ TUDO BEM Claro que eu verifiquei rota com netstat -rn e disse 10.2.0.1 default (corrigir). Mas telnet, links, yum e qualquer tipo de conexão falham! Apenas a resolução de ping e dns funciona (sic!) O que verificar?

    

Answer 1

Solução encontrada: firewall muito restritivo. Eu uso este /etc/firewall/pf.conf., funciona bem sem problema

# Vars
ext_if="net0"
int_if="net1"
ext_net="192.168.0.0/24"
int_net="10.2.0.0/24"
webports="{443, 80}"

##  make IP reassembly work
set reassemble yes no-df

## ignore loopback traffic
set skip on lo0

# block everything unless told otherwise
# and send TCP-RST/ICMP unreachable
# for every packet which gets blocked
block return in log all
pass out all

# Pass
pass in on $int_if proto tcp from $ext_net to any keep state
pass in on $int_if proto udp from $ext_net to any keep state
pass in on $int_if proto tcp from $int_net to any keep state
pass in on $int_if proto udp from $int_net to any keep state

# accept incoming SSH connections
pass in proto tcp from any to $ext_if port 22

# accept dhcp connections
pass in proto udp to any port 67:69
pass in proto tcp to any port 67:69

# accept dns connections
pass in proto udp to any port 53
pass in proto tcp to any port 53

# accept webeservers connections
pass in proto tcp to $ext_if port $webports

# accept icmp
pass in proto icmp all

## allow all connections initiated from this system,
## including DHCP requests
pass out

#nat
pass out on net0 from $int_net to any nat-to (net0)