David Raeker-Jordan wrote:
I am using iptables and ipmasq; might that be preventing pppd from dialing out? I got ipmasq working, but I am not very conversant with it.To answer my own question -- yes, ipmasq was preventing pppd from dialingout in demand mode. If I turn ipmasq off, then pppd will dial out on demand.Now I just need to determine what rule in ipmasq is causing the problem. Has anyone who has seen this before have any advice?
I can't answer your question directly, since I don't have your complete IPMASQ ruleset to look at, and I probably couldn't "read" it anyway (I am not an IPTABLES/IPCHAINS guru). Maybe this will help you solve your problem, though.
One thing to consider when writing rules for Firewalling and IPMASQ is the fact that the ppp0 (dial out) interface doesn't exist on the system until you actually dial-out and make a connection. It is quite transient. Most of the rulesets I have seen are based on forwarding between interfaces, hence any rule that forwards/masqs to the ppp0 interface will fail if the interface doesn't exist! The key here is to establish the connection then run the rule... in that order. There is no need for IPMASQ (normally) until you make the ppp0 connection, so there isn't really any need to run the IPMASQ rule until after the interface comes up.
This is essentially what you have found out.. the only thing missing is to establish the IPMASQ "rule" after the ppp0 interface is established You can do this with a script that re-runs (updates) the existing "rules" located in the /etc/ppp/ip-up.d/ directory. All of the scripts in this directory are run in cannonical order (whatever that means) after the link comes up. Of course, you can also do this manually from the command line...if you want (for testing purposes???).
Most packages I have seen that do FIREWALLING also include the capability to do IPMASQ. That is the way I have done it here for several years. I am currently using the "Firestarter" firewall, and it works quite nicely on iptables found in the 2.4.XX kernels. I also used the "PMFirewall" package on the ipchains found in the 2.2.XX kernels. There are LOTS of these programs available, and each one has its advantages and disadvantages. I would advise using one of these type packages and placing the calling script in /etc/ppp/ip-up.d/ direcory on a ppp dial-out connection. This is the most painless way I have found to get up & running so-far. If you are "rolling your own" for educational purposes, then just take the above into account in your design.
HTH, -Don Spoon-