What are the correct NETMASKs for multiple PPPoE interfaces in a StaticIP block?

What are the correct NETMASKs for multiple PPPoE interfaces in a StaticIP block?

[Gerianne McC]

Hi,

I'm connecting via PPPoE to my ISP (SBC).

I've a static IP /29 assigned to me (x.x.x.232 - x.x.x.239).

To 'get at' (for firewalling, etc, eventually) all the static IPs,
I've setup in-kernel PPPoE to negotiate the connection through
an ADSL mode config'd in bridge-mode.

I'm confused about assigning NETMASKs.

I'm making my primary ppp connection at interface

       ppp0, IP address = x.x.x.238

and setting up interface aliases of,

       ppp0:1, IP address = x.x.x.233
       ppp0:2, IP address = x.x.x.234
       ppp0:3, IP address = x.x.x.235
       ppp0:4, IP address = x.x.x.236
       ppp0:5, IP address = x.x.x.237

using an intfc cloning range defined in
"/etc/sysconfig/network-systems/ifcfg-ppp0-range0"

I plan to handle each interface ppp0 + ppp0:1-5 separately in my firewall.

Questions:

What should be the NETMASK for the primary 'ppp0'? /29 or /32?
And for each of the aliases?

If the right answer if ppp0 -> /29, & ppp0:# -> /32, should I ALSO
create an alias ppp0:6, IP address = x.x.x.238 (same as ppp0 !?) but
with a /32?

Thanks.

Geri :-)

Re: What are the correct NETMASKs for multiple PPPoE interfaces in a StaticIP block?

[James Carlson]

Gerianne McC writes:
> I'm making my primary ppp connection at interface
> 
>        ppp0, IP address = x.x.x.238
> 
> and setting up interface aliases of,
> 
>        ppp0:1, IP address = x.x.x.233
>        ppp0:2, IP address = x.x.x.234
>        ppp0:3, IP address = x.x.x.235
>        ppp0:4, IP address = x.x.x.236
>        ppp0:5, IP address = x.x.x.237

That should work, though it's perhaps not how I'd handle it.

> What should be the NETMASK for the primary 'ppp0'? /29 or /32?
> And for each of the aliases?

They're all /32 -- individual IP addresses.

PPP creates point-to-point interfaces.  It's not a broadcast-type
medium, like Ethernet.  There's no "subnet" as far as the interface is
concerned, but rather just two arbitrary IP nodes connected together.

That's why the link has a "local" address and a "remote" address, and
no "broadcast" address.  It's not a subnet.

> If the right answer if ppp0 -> /29, & ppp0:# -> /32, should I ALSO
> create an alias ppp0:6, IP address = x.x.x.238 (same as ppp0 !?) but
> with a /32?

Setting a /29 on a PPP interface should have no effect.  The system
should be smart enough to know that the right answer is /32.

-- 
James Carlson         42.703N 71.076W         <carlsonj@workingcode.com>

Re: What are the correct NETMASKs for multiple PPPoE interfaces in a StaticIP block?

[Gerianne McC]

Hi James,

>  >        ppp0:5, IP address = x.x.x.237
>
>  That should work, though it's perhaps not how I'd handle it.

I'm definitely in 'learning mode' -- how *would* you handle it?

>  > What should be the NETMASK for the primary 'ppp0'? /29 or /32?
>  > And for each of the aliases?
>
>  They're all /32 -- individual IP addresses.
>
>  PPP creates point-to-point interfaces.  It's not a broadcast-type
>  medium, like Ethernet.  There's no "subnet" as far as the interface is
>  concerned, but rather just two arbitrary IP nodes connected together.
>
>  That's why the link has a "local" address and a "remote" address, and
>  no "broadcast" address.  It's not a subnet.

"point to point".  You know, that simply never hit home.  Thanks for a
simple/clear explanation!

and, of course, you're right ... @ ifconfig, I see,

 for eth# interfaces, e.g.

	inet addr:10.0.0.100  Bcast:10.0.0.255  Mask:255.255.255.0
	UP BROADCAST RUNNING MULTICAST  MTU:1492  Metric:1
	
 whereas for ppp# interfaces,

	ppp0:5      Link encap:Point-to-Point Protocol
	inet addr:x.x.x.227  P-t-P:y.y.y.y  Mask:255.255.255.255
	UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1

i.e., no BROADCAST

>  Setting a /29 on a PPP interface should have no effect.  The system
>  should be smart enough to know that the right answer is /32.

The system maybe was ... as for me ;-)

Thanks again!

Geri :-)

Re: What are the correct NETMASKs for multiple PPPoE interfaces in a StaticIP block?

[James Carlson]

Gerianne McC writes:
> Hi James,
> 
> >  >        ppp0:5, IP address = x.x.x.237
> >
> >  That should work, though it's perhaps not how I'd handle it.
> 
> I'm definitely in 'learning mode' -- how *would* you handle it?

I'd likely route it -- I'd set up the PPP link on that one system,
then configure a /29 on an available Ethernet interface for that
address range, and route between the two.  To conserve addresses, I'd
assign the same IP address as the local address on the Ethernet link.
(Yes, that's legal.)

Since there are only two interfaces, "routing" becomes quite trivial
-- all you need is a single default route pointing to the remote
address on the PPP link, and that's something that pppd can provide
with the "defaultroute" option.

I'm not sure what use I'd have for a bunch of manually configured
statics that only one machine can use.  (Perhaps I'm missing part of
your planned deployment, though.)

-- 
James Carlson         42.703N 71.076W         <carlsonj@workingcode.com>

Re: What are the correct NETMASKs for multiple PPPoE interfaces in a StaticIP block?

[Gerianne McC]

Hi James,

>  I'd likely route it
...

Got it!

>  I'm not sure what use I'd have for a bunch of manually configured
>  statics that only one machine can use.  (Perhaps I'm missing part of
>  your planned deployment, though.)

Yes, there's "more to it"

Each of my StaticIPs is configured with unique RDNS domains.

My current approach is to expose each one of those StaticIPs as a
separate (aliased) PPPoE intfc -- hence the ppp0:# -- as the external
interfaces of a firewall.

Then, I'll use the firewall (usual tools -- NAT, forwarding, etc) to
map traffic t & through those interfaces to various servers/services
on my LAN and DMZ segments.

So, as you suspected -- it's not just "one machine"!

Geri :-)

Re: What are the correct NETMASKs for multiple PPPoE interfaces in a StaticIP block?

[James Carlson]

Gerianne McC writes:
> Each of my StaticIPs is configured with unique RDNS domains.
> 
> My current approach is to expose each one of those StaticIPs as a
> separate (aliased) PPPoE intfc -- hence the ppp0:# -- as the external
> interfaces of a firewall.
> 
> Then, I'll use the firewall (usual tools -- NAT, forwarding, etc) to
> map traffic t & through those interfaces to various servers/services
> on my LAN and DMZ segments.

OK; that makes more sense.  I would have expected separate firewalls
for each of those domains ... but this approach (though maybe unusual)
ought to work.

-- 
James Carlson         42.703N 71.076W         <carlsonj@workingcode.com>