Re: NAT and loopback

Phil Dibowitz wrote:
> [email protected] wrote:
>   
>> Hi guys
>>
>> I would like to create a local L4 load balancing so that the following
>> is true (the host has IP address 10.226.32.111):
>>
>> TCP connection to 127.0.0.1/port 1500 on the host gets redirected to
>> 10.226.33.150/1500 the first time.
>>     
>
> What OS? As far as I know, you can't do anything on the loopback interface
> in Solaris since it's not a real interface.
>   

Hi Phil, Miguel,

With the stock IP Filter in S10u6, or at least Solaris 10 8/07, you can:


http://docs.sun.com/app/docs/doc/816-4554/gdwzr?a=view

#

Stop Solaris IP Filter if it is running.


# *svcadm disable network/ipfilter*
        

#

Edit the /etc/ipf.conf or /etc/ipf6.conf file by adding the following 
line at the beginning of the file:


set intercept_loopback true;

This line must precede all the IP filter rules that are defined in the 
file. However, you can insert comments before the line, similar to the 
following example:


# 
# Enable loopback filtering to filter between zones 
# 
set intercept_loopback true; 
# 
# Define policy 
# 
block in all 
block out all 
<other rules>
...

#

Start the Solaris IP filter.


# *svcadm enable network/ipfilter*
        

#

To verify the status of loopback filtering, use the following command:


# *ipf ---T ipf_loopback*
ipf_loopback    min 0   max 0x1 current 1
#

If loopback filtering is disabled, the command would generate the 
following output:


ipf_loopback    min 0   max 0x1 current 0



Regards...

-- 
Simon-Bernard Drolet, SPecialiste X Inc., 514.247.6741.
SBDrolet<at>gmail(dot)com, Sun Solaris Contractor
Certified Sun Technical Instructor, Sun Certified System Admin (2.5,7,8,9,10)
Sun Certified Network Admin (2.5,7,8,9,10) and Security Admin for Solaris 9,10.