Subject: Re: nat configuration
To: Andrew Brown <>
From: Bill Studenmund <>
List: tech-net
Date: 01/09/2001 11:29:57
On Tue, 9 Jan 2001, Andrew Brown wrote:

> >Are you sure the userspace ppp implimentation can do that?
> yep.  i was sort of speaking from past experience, but just to be sure
> i verified it again.
>    # uname -srm
>    NetBSD 1.5K i386
>    # pkg_info -I userppp
>    userppp-001107      User-PPP package as found in FreeBSD and OpenBSD
> and i can get at two (probably more, but two is more than one to
> define my point) machines behind the nat pinging the same outside
> address (to demonstrate proper muxing/demuxing of the pings).
> >I use NAT over my DSL, and only one of the boxes inside my net can ping
> >out at the same time. It's not a ppp issue, and I'd be surprised if using
> >a different ppp made it work. :-)
> it's a nat issue, not a ppp issue.
> >The problem is that NAT doesn't support it.
> yes, i know.  that's the point.  ipnat, that is.  hmm...i wonder what
> ill effects i'd get from using the userspace ppp with aliasing (ie,
> nat) turned on as well as ipnat...
> >Hmmm.... I just tried it, and now it works! I thought it didn't used to.
> >Either I misremembered, or it's been fixed.
> um...what works?  a more current nat can mux pings?

Yes. My 1.5 NAT box seems to be multiplexing pings. I had one box ping, and another ping, and they both worked. My
nat config looks like yours, except that I have my hard IP in there
instead of, and I am using the outgoing ethernet card. :-)

> >All my machines are running 1.5.
> all my machines are running current with less than a two month lag
> behind today.

I hope it didn't get fixed then broken.

> >If it really works with userland ppp (which I thought was a downgrade from
> >1.5's ppp) but not kernel ppp, then there's a ppp bug.
> the userspace ppp is, afaik, a *completely* separate and distinct
> implementation of ppp.  all it requires of the kernel is a serial
> interface (with a modem) and a tunnel interface (for packets to go
> through).  it's not a downgrade...perhaps a "sidegrade".

I thought they were based on the same ppp project. The reason for the ppp
package was that it's set to version 2.3.11, which is newer than the ppp
in 1.4. But 1.5 and current are using ppp 2.4, which is newer, thus an
overall downgrade.

> the nat (called aliasing) in the userspace ppp is what actually
> handles the multiple outbound pings.  i imagine it's fiddling with the
> icmp echo request identifier and using it as it uses the local port
> number rewriting for udp and tcp.

Does it work with that aliasing off?

Take care,