System Administration Guide: IP Services

How to Append Rules to the NAT Rules

Assume a role that includes the IP Filter Management rights profile, or become superuser.
You can assign the IP Filter Management rights profile to a role that you create. To create the role and assign the role to a user, see "Configuring RBAC (Task Map)" in System Administration Guide: Security Services.
Use one of the following methods to append rules to the active rule set:
- Append rules to the NAT rule set at the command line using the ipnat -f - command.
  # echo "map dmfe0 192.168.1.0/24 -> 20.20.20.1/32" | ipnat -f -
- Perform the following commands:
  1. Create additional NAT rules in a file of your choice.
  2. Add the rules you have created to the active NAT rules.
    # ipnat -f filename
    The rules in filename are added to the end of the NAT rules.

Example 26-12 Appending Rules to the NAT Rule Set

The following example shows how to add a rule to the NAT rule set from the command line.

# ipnat -l
List of active MAP/Redirect filters:

List of active sessions:
# echo "map dmfe0 192.168.1.0/24 -> 20.20.20.1/32" | ipnat -f -
# ipnat -l
List of active MAP/Redirect filters:
map dmfe0 192.168.1.0/24 -> 20.20.20.1/32

List of active sessions:

Managing Address Pools for Solaris IP Filter

Use the following procedures to manage, view, and modify address pools.

How to View Active Address Pools

Assume a role that includes the IP Filter Management rights profile, or become superuser.
You can assign the IP Filter Management rights profile to a role that you create. To create the role and assign the role to a user, see "Configuring RBAC (Task Map)" in System Administration Guide: Security Services.
View the active address pool.
# ippool -l

Example 26-13 Viewing the Active Address Pool

The following example shows how to view the contents of the active address pool.

# ippool -l
table role = ipf type = tree number = 13
        { 10.1.1.1/32, 10.1.1.2/32, 192.168.1.0/24; };

How to Remove an Address Pool

Assume a role that includes the IP Filter Management rights profile, or become superuser.
You can assign the IP Filter Management rights profile to a role that you create. To create the role and assign the role to a user, see "Configuring RBAC (Task Map)" in System Administration Guide: Security Services.
Remove the entries in the current address pool.
# ippool -F

Example 26-14 Removing an Address Pool

The following example shows how to remove an address pool.

# ippool -l
table role = ipf type = tree number = 13
        { 10.1.1.1/32, 10.1.1.2/32, 192.168.1.0/24; };
# ippool -F
1 object flushed
# ippool -l

How to Append Rules to an Address Pool

Assume a role that includes the IP Filter Management rights profile, or become superuser.
You can assign the IP Filter Management rights profile to a role that you create. To create the role and assign the role to a user, see "Configuring RBAC (Task Map)" in System Administration Guide: Security Services.
Use one of the following methods to append rules to the active rule set:
- Append rules to the rule set at the command line using the ippool -f - command.
  # echo "table role = ipf type = tree number = 13 {10.1.1.1/32, 10.1.1.2/32, 192.168.1.0/24};" | ippool -f -
- Perform the following commands:
  1. Create additional address pools in a file of your choice.
  2. Add the rules you have created to the active address pool.
    # ippool -f filename
    The rules in filename are added to the end of the active address pool.

Example 26-15 Appending Rules to an Address Pool

The following example shows how to add an address pool to the address pool rule set from the command line.

# ippool -l
table role = ipf type = tree number = 13
        { 10.1.1.1/32, 10.1.1.2/32, 192.168.1.0/24; };
# echo "table role = ipf type = tree number = 100
 {10.0.0.0/32, 172.16.1.2/32, 192.168.1.0/24};" | ippool -f -
# ippool -l
table role = ipf type = tree number = 100
        { 10.0.0.0/32, 172.16.1.2/32, 192.168.1.0/24; };
table role = ipf type = tree number = 13
        { 10.1.1.1/32, 10.1.1.2/32, 192.168.1.0/24; };