/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
TOTSCHNIG MICHAEL <[EMAIL PROTECTED]> wrote:
>
> i have configured my SuSE-6.2 linux network (one machine connected to
> the internet via a PPP-modem-connection, another linked to it via
> ethernet) according to the description in the Linux IP Masquerade
> HOWTO, and masquerading is working fine, when my PPP-Conection is up.
> There is unfortunately one problem when it is down.
I guess I have a question to ask, before I get into this: What do you
really *expect* to happen, when the PPP link is down? If the link is
down, then no connection is possible, and yet you are attempting to
initiate a connection anyway! Why? Shouldn't you bring up the link,
and then initiate contact?
It seems to me that you might expect one of two activities to occur:
1. The connection fails with an error immediately on the attempting
client.
2. The connection is brought up automatically by the masq box.
instead, you're getting
3. The connection just hangs forever, then eventually times out.
I believe that you can configure your masq box to do any of these three
things, and apparently you have it set up to do #3. :)
> The problem is that when there is no connection to my ISP, when the
> masqued machine is trying to reach a machine outside my LAN, the
> program originating the demand hangs,
It sounds like the masq box isn't replying with any sort of "destination
unreachable" ICMP packet, which is what it really should do, if it is
attempting to forward a packet, and cannot find a suitable route. When
the PPP connection is down, is there still a default route pointing
someplace, on the masq box? If so, where? And why?
I have posted previously on this list about how to get a PPP connection
to connect automatically when connections are initiated, so I won't go
into it here; search the archives, and I'm sure you'll find the
information.
If there is no default route on the masq box, then I'm rather puzzled as
to why the connection doesn't get cut short. Do you filter ICMP
messages? If you watch the connection attempt, from the masq box, with
tcpdump, do you see any ICMP replies being sent? Are they ignored by
the client? Interesting...
> I have set up a caching DNS server on my Linux box, but I am afraid I
> don't know how to configure it correctly. I use bind 4.9.7-73 and set
> into /etc/named.boot
The latest versions of BIND do not use a named.boot config file, but
have switched to a different command structure, stored in a file called
/etc/named.conf.
There should be a small perl script included with the BIND distribution,
that converts a named.boot file to the named.conf format. Or, perhaps a
configuration like this will work for you:
options {
directory "/var/bind";
statistics-interval 0;
forward only;
forwarders {
x.x.x.x;
};
};
zone "." {
type hint;
file "root.cache";
};
You can change "/var/bind" to whatever directory you've stored your
"root.cache" file in.
> The result is that now on my Linux box, when I try to resolv a
> hostname outside the LAN when the PPP-link is down, the program hangs
> (netsacpe craches).
May I assume that you did tell your masq'd client to use the masq box
for resolving its DNS queries? It's not still trying to reach the ISP's
server? Note, though, that when you've just started up the DNS server,
it has an empty cache, and so any attempt by a client to query a name,
will simply cause the masq box to attempt the same thing, and with no
PPP connection, it'll simply fail, in exactly the same way. Setting up
a DNS caching server only allows future lookups, that do succeed, to
happen faster, if they are re-requested later. Since browsers tend to
generate a lot of repeated name lookups, this is a useful optimization,
even if it doesn't fix this problem.
--
[EMAIL PROTECTED] (Fuzzy Fox) || "Good judgment comes from experience.
sometimes known as David DeSimone || Experience comes from bad judgment."
http://www.dallas.net/~fox/ || -- Life Lessons
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
