compartment network rules

[Niklas Wirström]

Hello.
I would like to make all processes belonging to a certain compartment use a specific network interface for in- and out-bound traffic.

I have tried to create a virtual interface, and set the compartment-network-rules to only allow traffic from that interface.
The problem seems to be that the default route still goes via the lan0 interface.

Any suggestions?

This is what i have done:

lanadmin -V create vlanid 454 0
BASE=$(lanadmin -V basevppa)
ifconfig lan$BASE inet 10.0.0.12 netmask 255.255.255.0 up
cp /bin/bash ~/bash
setfilexsec -c test_cmpt ~/bash
~/bash
ping anotherhost

------

The ping command just hangs and "tcpdump -i lan$BASE" (from outside the compartment) doesn't show anything when I do the pinging.

/Niklas W.

[Steven E. Protter]

Shalom,

When you create a virtual lan, all the traffic actually transits the master lan ip address.

Users thinkg they are using the virtual lan, but tcpdump shows the actual traffic passed through the master interface.

The virtual ip address is a device to make users or applications think there is another ip address, but to the system running it, its almost like smoke and mirrors.

This appears to be normal function based on what you did.

SEP

[Niklas Wirström]

Ok, Thanks.
Do you know about any other way of creating virtual interfaces on HPUX (preferably supported by HP).

/Niklas

[Peter Sedivy]

Hello HP-UX allows you to create virtual aliases for specific interface.
it's quite simple.
try to issue something like this:

ifconfig lan0:1 inet 10.0.0.3 netmask 255.255.255.0 up

this command allows you to create alias for lan0 named "1" with specified ip/netmask

netstat -i alliows you to display list of all your configured interfaces (aliased also)