About 14 months ago, MASQUERADE target was modified to only flush conntracks
on interface up/down if the IP address changed [1].  Unfortunately, there were
a few problems with this change:

1) ina->ifa_address was used as the IP address of the interface for
   comparison purposes.  This works great for ethernet interfaces
   since ifa_address and ifa_local are identical.  But on ppp interfaces
   ifa_address is the address of the remote side, not the local side

2) dev->ifindex was used to determine whether the interface which cycled
   matches the interface the conntrack is masquerading out.  Again, this
   works fine for ethernet (static ifindex), but not at all for ppp which
   uses sequentially increasing interface indexes.  The ifindex associated
   with pppX increments on each up/down cycle

3) even if #2 were not true, in a scenario where multiple ppp interfaces
   are utilized, the order in which they are cycled makes the ifindex
   comparison haphazard

The below patch addresses these issues by returning to the old behavior
for ppp interfaces: flush all conntracks masquerading out that interface
on device down.  I can think of no other foolproof way to ensure the proper
conntracks get destroyed.

This fixes Bugzilla #227

Phil

[1] http://linux.bkbits.net:8080/linux-2.5/diffs/net/ipv4/netfilter/ipt_MASQUERADE.c@1.11?nav=index.html|src/.|src/net|src/net/ipv4|src/net/ipv4/netfilter|hist/net/ipv4/netfilter/ipt_MASQUERADE.c