Integrating ipmasq with whatever system you use to connect
networks is a simple matter of running /usr/sbin/ipmasq when ever
the routing changes or an interface goes up or down.
ipmasq utilizes the debconf configuration management
system for interacting with the administrator during package installation and
normal system operations. Ipmasq may be reconfigured at any time
by running dpkg-reconfigure ipmasq as root.
[Below information is Brian's approach. Osamu's preferred approach is to use
ifupdown infrastructure and edit /etc/network/interfaces as
described in "Debian Reference".]
ipmasq installs a script in the /etc/init.d
directory, and uses update-rc.d to install symlinks into
/etc/rcX.d directories. The boot-time behavior of
ipmasq may be disabled, started after network interfaces are
brought up (in single user runlevel 'S', ipmasq starts at 41 and
ipmasq-kmod starts at 42), started after network filesystems have
been mounted (in single user runlevel 'S', ipmasq starts at 46 and
ipmasq-kmod starts at 47), or started after network services have
been started (in normal runlevels, ipmasq starts at 21 and
ipmasq-kmod starts at 22). This behavior is controlled through
the debconf configuration mechanism (see Configuration, Section 4.1).
[Below information is Brian's approach. Osamu's preferred approach is to use
ifupdown infrastructure and edit /etc/network/interfaces as
described in "Debian Reference".]
When a computer using ipmasq that gets its networking
configuration though DHCP boots, ipmasq can start too early in the
boot process. This can cause the generated ruleset to not allow network
traffic to flow over the DHCP-configured interfaces.
To fix this, ipmasq should be configured to start "After
network services have been started".
Also, since DHCP allows for network information to be changed after bot-time
initialization (which violates one of ipmasq's assumptions; see Assumptions, Section 2.3),
ipmasq must be run whenever the IP address assigned to the host is
changed. Please consult the documentation for your DHCP client for information
on how to do this. For the ISC DHCP client (debian package
dhcp-client), the contents of
/usr/share/doc/ipmasq/examples/dhclient-exit-hooks must be added
to your /etc/dhclient-exit-hooks file.
[Below information is Brian's approach. Osamu's preferred approach is to use
ifupdown infrastructure and edit /etc/network/interfaces as
described in "Debian Reference".]
The package ipmasq installs scripts into the ip-up
and ip-down mechanism of pppd. These scripts check
for the presence of a file (/etc/ipmasq/ppp) before running
/usr/sbin/ipmasq. Remove this file to not have
ipmasq run when pppd brings the link up or down.
Please note that doing so is not recommended.
The debconf configuration mechanism (see Configuration, Section 4.1) provides a simple mechanism
for creating or removing this file.
Diald is a system which allows a link to be brought up and down based on network traffic. Diald accomplishes this bit of routing prestidigitation by setting up a proxy interface to be the system's default route and monitoring traffic on that interface.
On Debian systems, diald (by default) starts in runlevel 2, while
ipmasq typically starts during the boot process (technically,
runlevel S). [Osamu: if ifupdown is used instead, this is not true.]
ipmasq runs first, and intializes a firewall that does not include
the proxy route. diald then starts, and creates a new route
without informing ipmasq that the underlying routing has changed.
As a result of the firewall not including the proxy route, no packets will be
sent along the proxy, and diald will not bring the link up.
To solve this problem, ipmasq must be configured (see Configuration, Section 4.1) such that boot time
initialization is disabled. [1]
Also, if your system does not utilize PPP, invocations of
/usr/sbin/ipmasq must be added to your ipup and
ipdown scripts. (If your system uses PPP, the facilities in place
for using pppd will handle it. For more information, see PPP, Section 4.4.)
Hopefully, future versions of the Debian diald package will use a
setup where other packages can drop scripts in a directory to have them run
when diald runs a script. ipmasq will support this scheme when
implemented.
[Below information is Brian's approach. This is good for most server with fixed IP and easy to understand. ]
[ Osamu's preferred alternative approach is to use ifupdown infrastructure and
edit /etc/network/interfaces as described in README.Debian. This
has some negatives. It also requires to edit
/etc/pcmcia/network.opts to disable last parts as described in
"Debian Reference".]
The pcmcia-cs package provides support for ipmasq.
In the file /etc/pcmcia/network.opts, simply define a variable
IPMASQ to have a value of y, as shown in the example
below:
------ Begin /etc/pcmcia/network.opts snippet -------
# Run ipmasq? [y/n] (see the Debian ipmasq package)
IPMASQ="y"
------- End /etc/pcmcia/network.opts snippet --------
Please note that this is needed only if you have a PC Card network card. A PC
Card modem will typically use pppd. For more information about
setting up pppd, please see PPP, Section
4.4.
Additionally, ipmasq should be set to disable the boot-time
initialization (see Boot-time Initialization, Section
4.2).
Ipmasq User's Manual
Brian Bassettbrianb@debian.orgosamu@debian.org