Solaris

I'm having a hard time getting IP forwarding to work. I'll eventually have several interfaces, but all that matters for now is that two of them actually be able to IP forward. I have no network interfaces in the global zone, but both interfaces are in the same zone, Common.

The IPs I've been testing with:

10.50.20.1 Local interface, tied to e1000g0:1 and in the zone Common.
10.50.20.10 remote and directly connected to 10.50.20.1
10.50.40.1 Local interface, tied to e1000g2:1 and in the zone Common.
10.50.40.10 remote and directly connected to 10.50.40.1

From a zlogin to my zone Common, I can ping either of these interfaces: the packets go out the expected wire, and I get a response immediately.

From either of the remote machines, I can ping my machine on the interface it is directly connected to (10.50.20.10 can ping 10.50.20.1). But if I try to ping 10.50.40.10 from 10.50.20.10, it goes out on the wire, is not picked up by my machine, and nothing happens on the other wire- no IP forwarding occurs.

A netstat -rn executed from zone Common gives the following:

Code:

Destination     Gateway     Flags   Ref   Use   Interface
10.50.20.0      10.50.20.1    U      1     0    e1000g0:1
10.50.20.10     10.50.20.1    UH     1     6    e1000g0:1
10.50.40.0      10.50.40.1    U      1     0    e1000g2:1
10.50.40.10     10.50.40.1    UH     1     3    e1000g2:1

ifconfig -a gives me all my interfaces. The relevant ones:

First the physical:
e1000g0 BROADCAST RUNNING MULTICAST ROUTER IPV4
zone Common
inet 0.0.0.0 netmask 0

Then it gives the virtual interface:
e1000g0:1 UP BROADCAST RUNNING MULTICAST ROUTER IPV4
zone Common
inet 10.50.20.1 netmask ffffff00

The other physical:
e1000g2 BROADCAST RUNNING MULTICAST ROUTER IPV4
zone Common
inet 0.0.0.0 netmask 0

Then it gives the other virtual interface:
e1000g2:1 UP BROADCAST RUNNING MULTICAST ROUTER IPV4
zone Common
inet 10.50.40.1 netmask ffffff00

/etc/netmasks assigns 255.255.255.0 to each.

/etc/networks looks about like:
network-a 10.50.20
network-b 10.50.40

If I type routeadm, I find that ipv4-routing is enabled (I've tried it with it disabled too, it shouldn't be needed), and that ipv4-forwarding is enabled (it definitely needs to be on, right?). For routing services, I have:
route:default
ripng:default

For Routing Daemons I have:
Disabled svc:/network/routing/legacy-routing:ipv4
Disabled svc:/network/routing/legacy-routing:ipv6
Online svc:/network/routing/ndp:default
Online svc:/network/routing/rdisc:default
Disabled svc:/network/routing/ripng:default
Online svc:/net0work/routing/route:default


Are there any other checks I should do? The ipv4-forwarding being active is as a result of the "routeadm -e ipv4-forwarding" command. This was all trivial under tsol, just a couple ndd commands.

Currently ipfilter explicitly calls out at the top of /etc/ipf/ipf.conf (just because I want it to work):

pass in log quick from any to any
pass out log quick from any to any

Earlier, I took an approach and tried to get NAT to work, even though I don't want the addressed translated at all (10.50.20.10 knows what 10.50.40.10 is, and knows that it wants to route it through 10.50.20.1, at least enough to put the ping on that wire). During that experiment, I tried the following rules (which are probably not correct):

pass in quick on e1000g0 from 10.50.20.0/255.255.255.0 to any keep state
pass in quick on e1000g2 from 10.50.40.0/255.255.255.0 to any keep state

When I had that active, I also tried /etc/ipf/ipnat.conf as:

map e1000g0 10.50.20.0/24 -> 10.50.20.0/24
map e1000g2 10.50.40.0/24 -> 10.50.40.0/24

Because I don't really know what I'm doing with the NATing, I also tried the following instead of that:

map e1000g0 10.50.20.0/24 -> 0/32
map e1000g2 10.50.40.0/24 -> 0/32

(that one broke stuff hard)

map e1000g0 10.50.20.0/24 -> 0/0
map e1000g2 10.50.40.0/24 -> 0/0

(that also didn't work)

I'm pretty sure I'm doing the NAT incorrectly, but I'm also thinking I shouldn't need it at all (and much of my poking has been without it at all), being as I just want the stupid packets dumped on the other interface.