13:51:36 <extrowerk> so "ipmon -o S" doesn't show anything when i try to use dig in a NGZ, so it isn't the firewall.
13:53:05 <extrowerk> but enabling the block breaks dns in the NGZ, so it is firewall
14:03:46 <extrowerk> managed to fix it with pass in quick on vnic0 from 10.10.0.0/24 to any keep state
14:16:53 <m1ari> I don't know if one exists for ipf/illumous, but when doing firewall stuff before (mostly on Linux) I've found getting a diagram of how packets flow around the filter/nat stack(s) can be very useful 
14:24:48 <m1ari> also if you haven't already, it's probably worth a read of https://omnios.org/info/ipfilter
14:45:31 <extrowerk> m1ari: thanks for the hints, i have already read the linked article.
14:47:19 <extrowerk> Back to my earlier question: i have an OmniOS NAS in my LAN and a clous OmniOS VPS instance. What would be the most efficient way to build a vpn between them. AFAIK the tun driver is not efficient.
14:48:21 <extrowerk> but every vpn solution relies on tun/tap, so I am wondering if there is any other option? MAybe an ssh tunnel maintained by SMF?
14:55:20 <m1ari> what do you mean by not efficient? is it actually a problem ?
14:56:54 <m1ari> I've not done much with VPNs, but when I did do some site to site tunnels they were generally an ipsec tunnel using something like tun/tap.
14:58:14 <m1ari> as a broad generalisation, any vpn solution is going to be slower than a native connection as you're having to encapsulate the IP packets inside another IP stream.
14:58:15 <extrowerk> I have read the Illumos port of the tun/tap driver ispretty old, doesn't follow the current driver arch and it should be rewritten.
15:00:34 <m1ari> Again as a generalisation potential issue on a VPN is that a single packet inside the VPN, could require 2 (or more) packets to be sent between the two end points
16:46:06 <extrowerk> ok dns and zrepl works now
16:46:30 <extrowerk> both have an own sparse zone, zrepl works with a delegated zfs dataset