so "ipmon -o S" doesn't show anything when i try to use dig in a NGZ, so it isn't the firewall.

but enabling the block breaks dns in the NGZ, so it is firewall

managed to fix it with pass in quick on vnic0 from 10.10.0.0/24 to any keep state

I don't know if one exists for ipf/illumous, but when doing firewall stuff before (mostly on Linux) I've found getting a diagram of how packets flow around the filter/nat stack(s) can be very useful

also if you haven't already, it's probably worth a read of omnios.org/info/ipfilter

m1ari: thanks for the hints, i have already read the linked article.

Back to my earlier question: i have an OmniOS NAS in my LAN and a clous OmniOS VPS instance. What would be the most efficient way to build a vpn between them. AFAIK the tun driver is not efficient.

but every vpn solution relies on tun/tap, so I am wondering if there is any other option? MAybe an ssh tunnel maintained by SMF?

what do you mean by not efficient? is it actually a problem ?

I've not done much with VPNs, but when I did do some site to site tunnels they were generally an ipsec tunnel using something like tun/tap.

as a broad generalisation, any vpn solution is going to be slower than a native connection as you're having to encapsulate the IP packets inside another IP stream.

I have read the Illumos port of the tun/tap driver ispretty old, doesn't follow the current driver arch and it should be rewritten.

Again as a generalisation potential issue on a VPN is that a single packet inside the VPN, could require 2 (or more) packets to be sent between the two end points

ok dns and zrepl works now

both have an own sparse zone, zrepl works with a delegated zfs dataset