Subject: Re: ipnat -- first connection after DoD
To: None <netbsd-help@netbsd.org>
From: Wolfgang Rupprecht <wolfgang@wsrcc.com>
List: netbsd-help
Date: 10/07/1999 09:28:33
Hi Ingolf,

ingolf@djo-jena.de (Ingolf Koch) writes:
> On Thu, Oct 07, 1999 at 09:33:19AM +0000, Wolfgang Rupprecht wrote:
> > This is how TCP works.  You can not change IP addresses after a TCP
> > connection has been opened. 
> 
> Yes, but the firewall does not even let SYN packets get through,
> so there is no TCP connection at all. What happens is the following:

I see.  This is a different problem than I was thinking of.

> Maybe I am totally wrong. Is there any technical reason why
> this is not possible?

It doesn't look like a technical problem as much as a code problem.
I'm sure it can be made to work with a large enough effort to
rearrange the code.

There are shell scripts that can be run when a PPP interface comes up.
You might try to add the following to that file. (untested)

	ipf -F a -f /etc/ipf.conf
	ipnat -F

If some variant of the above doesn't work, you should send a PR with
send-pr and include your second explanation.  Perhaps Darren Reed will
have some insight on how hard it would be to do this automatically
within his code.

-wolfgang
-- 
       Wolfgang Rupprecht <wolfgang+gnus@dailyplanet.wsrcc.com>
		    http://www.wsrcc.com/wolfgang/
DGPS signals via the Internet  http://www.wsrcc.com/wolfgang/gps/dgps-ip.html