From a58d122bc59aaa091b580d5c244fe33e8ce4d401 Mon Sep 17 00:00:00 2001
From: gferg <>
Date: Mon, 23 Oct 2000 15:46:39 +0000
Subject: [PATCH] updated

---
 LDP/howto/linuxdoc/Assembly-HOWTO.sgml       |  49 +-
 LDP/howto/linuxdoc/BogoMips.sgml             |  73 +-
 LDP/howto/linuxdoc/VPN-Masquerade-HOWTO.sgml | 670 ++++++++++++++-----
 3 files changed, 588 insertions(+), 204 deletions(-)

diff --git a/LDP/howto/linuxdoc/Assembly-HOWTO.sgml b/LDP/howto/linuxdoc/Assembly-HOWTO.sgml
index 6cb4ec1d..e52ac2e5 100644
--- a/LDP/howto/linuxdoc/Assembly-HOWTO.sgml
+++ b/LDP/howto/linuxdoc/Assembly-HOWTO.sgml
@@ -16,7 +16,7 @@
 <url url="mailto:konst@linuxassembly.org" name="Konstantin Boldyshev"> and
 <url url="mailto:fare@tunes.org" name="Francois-Rene Rideau">
 
-<date>v0.5l, August 23, 2000
+<date>v0.5m, October 22, 2000
 
 <abstract>
 This is the Linux Assembly HOWTO.
@@ -161,6 +161,11 @@ I would like to thank following persons, by order of appearance:
 Each version includes a few fixes and minor corrections,
 that need not to be repeatedly mentioned every time.
 <descrip>
+<tag/Version 0.5m	22 Oct 2000/
+    Linux 2.4 system calls can have 6 args,
+    Added ALD note to FAQ,
+    fixed mailing list subscribe address
+
 <tag/Version 0.5l	23 Aug 2000/
     Added TDASM, updates on NASM
 
@@ -809,9 +814,11 @@ from the cell pointed to by <tt/&percnt;ebp/).
 A program exists to help you convert programs 
 from TASM syntax to AT&amp;T syntax. See
 	<url url="ftp://x2ftp.oulu.fi/pub/msdos/programming/convert/ta2asv08.zip">.
-(Since the original x2ftp site is closing (no more?), use a
+<!-- 
+	(Since the original x2ftp site is closing (no more?), use a
 	<url url="ftp://ftp.lip6.fr/pub/pc/x2ftp/README.mirror_sites"
 		name="mirror site">).
+-->
 There also exists a program for the reverse conversion:
 	<url url="http://www.multimania.com/placr/a2i.html">.
 
@@ -1561,13 +1568,20 @@ examine <ref id="res" name="Linux Assembly resources">.
 Basically, you issue an <tt/int 0x80/,
 with the <tt/&lowbar;&lowbar;NR&lowbar;/syscallname number
 	(from <tt>asm/unistd.h</tt>)
-in <tt/eax/, and parameters (up to five) in
-<tt/ebx, ecx, edx, esi, edi/ respectively.
+in <tt/eax/, and parameters (up to six [*]) in
+<tt/ebx, ecx, edx, esi, edi, ebp [*]/ respectively ([*] - Linux 2.4 only,
+previous versions have only 5 parameters).
 Result is returned in <tt/eax/, with a negative result being an error,
 whose opposite is what libc would put in <tt/errno/.
 The user-stack is not touched,
 so you needn't have a valid one when doing a syscall.
 
+<url url="http://www.linuxdoc.org/LDP/lki/" name="Linux Kernel Internals">,
+and especially
+<url url="http://www.linuxdoc.org/LDP/lki/Linux-Kernel-Internals-2.html#ss2.11"
+name="How System Calls Are Implemented on i386 Architecture?">
+chapter will give you more robust overview.
+
 As for the invocation arguments passed to a process upon startup,
 	the general principle is that the stack
 	originally contains the number of arguments <tt/argc/,
@@ -1897,17 +1911,16 @@ If you're are interested in Linux/UNIX assembly programming
 (or have questions, or are just curious)
 I especially invite you to join Linux assembly programming mailing list.
 
-This is an open discussion of assembly programming under Linux, FreeBSD, BeOS,
+This is an open discussion of assembly programming under Linux, *BSD, BeOS,
 or any other UNIX/POSIX like OS; also it is not limited to x86 assembly
 (Alpha, Sparc, PPC and other hackers are welcome too!).
 
+To subscribe send a blank message to <url url="mailto:linux-assembly-subscribe@egroups.com">.
+
 List address is <url url="mailto:linux-assembly@egroups.com">.
 
-To subscribe send a blank message to <url url="mailto:linux-assembly@egroups.com">.
-
 List archives are available at <url url="http://www.egroups.com/list/linux-assembly/">.
 
-
 <sect1>Frequently asked questions (with answers)<label id="faq">
 <p>
 Here are frequently asked questions. Answers are taken
@@ -1971,13 +1984,15 @@ and get it working. After that, the sky's the limit.
 <sect2>How do I debug pure assembly code under Linux?
 <p>
 
-If you're using <tt/gas/, you should consult
-<url url="http://www.cs.pdx.edu/~bjorn/CS200/linux_tutorial/"
-name="Linux assembly Tutorial"> by Bjorn Chambless.
+There's an early version of the
+<url url="http://www.ellipse.magenet.com/ald.html"
+name="Assembly Language Debugger">,
+which is designed to work with assembly code,
+and is portable enough to run on Linux and *BSD.
+It is already functional and should be the right choice, check it out!
 
-With <tt/nasm/ situation is a bit different, since it doesnot
-support gdb specific debugging extensions.
-Although <tt/gdb/ is source-level debugger, it can be used to debug
+You can also try <tt/gdb/ ;).
+Although it is source-level debugger, it can be used to debug
 pure assembly code, and with some trickery you can make <tt/gdb/ to do what you need.
 Here's an answer from <url url="mailto:dl@gazeta.ru" name="Dmitry Bakhvalov">:
 
@@ -2023,6 +2038,10 @@ If you want to set breakpoints across your code, you can just use
 <tt/int 3/ instruction as breakpoint (instead of entering address
 manually in <tt/gdb/).
 
+If you're using <tt/gas/, you should consult <tt/gas/ and <tt/gdb/ related
+<url url="http://linuxassembly.org/resources.html#tutorials" name="tutorials">.
+
+
 <sect2>Any other useful debugging tools?
 <p>
 Definitely <tt/strace/ can help a lot (<tt/ktrace/ and <tt/kdump/ on FreeBSD),
@@ -2035,7 +2054,7 @@ Read its manual page (<tt/man strace/) and <tt/strace --help/ output for details
 Noway. This is protected mode, use OS services instead.
 Again, you can't use <tt/int 0x10/, <tt/int 0x13/, etc.
 Fortunately almost everything can be implemented
-through system calls or library functions.
+by means of system calls or library functions.
 In the worst case you may go through direct port access,
 or make a kernel patch to implement needed functionality.
 
diff --git a/LDP/howto/linuxdoc/BogoMips.sgml b/LDP/howto/linuxdoc/BogoMips.sgml
index a1836458..b83ec337 100644
--- a/LDP/howto/linuxdoc/BogoMips.sgml
+++ b/LDP/howto/linuxdoc/BogoMips.sgml
@@ -3,7 +3,7 @@
 <title>BogoMips mini-Howto
 <author>Wim van Dorst, <htmlurl url="mailto:baron@clifton.hobby.nl"
 name="baron@clifton.hobby.nl">
-<date>Version 2000-09-22
+<date>Version 2000-10-21
 <abstract>
 This text gives some information about BogoMips, compiled
 from various sources such as news and e-mail. 
@@ -43,17 +43,17 @@ ratings, are reported directly to me, or published on Usenet.
 <sect1>The highest single-CPU Linux boot sequence BogoMips value
 <p>
 <itemize>
-<item>Robert A. Morris, <tt/ramorris@yifan.net/
-<item>AMD Athlon at 800MHz
-<item>1605.63 BogoMips
+<item>Rob Farrell <tt/rpf@speakeasy.net/
+<item>Intel Pentium III, at 866 MHz
+<item>1723.60 BogoMips
 </itemize>
 
 <sect1>The highest multiple-CPU Linux boot sequence BogoMips value
 <p>
 <itemize>
-<item>Richard Langis, <tt/rlangis@primux.geekfest.net/
-<item>8x Pentium III (Xeon) at 500 MHz, SMP
-<item>3996.06 BogoMips
+<item>Peter Rival <tt/frival@zk3.dec.com/
+<item>31x Alpha EV67 CPUs, at 731 MHz, SMP
+<item>46170.90 BogoMips
 </itemize>
 
 <sect1>The highest non-Linux BogoMips value
@@ -101,7 +101,7 @@ something which is a fake. Hence, the BogoMips value
 gives some indication of the processor speed, but it is
 way too unscientific to be called anything but BogoMips.
 <p>
-The reasons (there are two) it is printed during bootup
+The reasons (there are two) it is printed during boot-up
 is that a) it is slightly useful for debugging and for
 checking that the computers caches and turbo button work,
 and b) Linus loves to chuckle when he sees confused
@@ -175,7 +175,7 @@ CPUs is similar but not the same.
 
 <sect1>How to determine what the current BogoMips rating is
 <p>
-There are three methods to determing the current BogoMips, viz. 
+There are three methods to determine the current BogoMips, viz. 
 
 <enum>
 <item>looking in <tt>/proc/cpuinfo</tt>, e.g., with 
@@ -196,12 +196,12 @@ program. From the readme file by Jeff Tranter, <tt/jeff_tranter@mitel.com/:
 
 <quote>
 `Tired of rebooting your system so you can see how many
-BogoMIPS it's running at today?  [...] "Bogomips" is a
+BogoMips it's running at today?  [...] "Bogomips" is a
 standalone program that displays your system performance
 using one of the world's most recognized benchmarks.  It
 uses the same code that is used in the Linux kernel while
 booting, but runs as a user program. [...] Version 1.3 of
-BogoMIPs is now portable and should run on any system
+BogoMips is now portable and should run on any system
 that supports an ANSI C compiler and library.'
 </quote>
 
@@ -300,7 +300,7 @@ referred to as BogoBoost software. Cyrix 5x86 and 6x86 CPUs may
 have their BogoMips improved drastically by branch-prediction 
 (BIOS option). Note that the performance improvement may be
 marginal. There are several packages available for adjusting 
-Cyrix CPUs, such as the bogoboost patch, cx5x86mod, and set6x86, 
+Cyrix CPUs, such as the BogoBoost patch, cx5x86mod, and set6x86, 
 all from the normal archives, in obvious places. It is reported
 the Cyrix 6x86 CPUs may give better performance when the kernel is 
 compiled with 486-optimization, instead Pentium-optimization.
@@ -352,7 +352,7 @@ approximately 50 different countries. Note that the ratings here are
 from the actual Linux booting sequence, except of course for the 
 section on Non-Linux Systems.
 
-<sect1>Oddly or faultly configured 386 systems
+<sect1>Oddly or faultily configured 386 systems
 <p>
 <verb>
    System              BogoMips  Reporter
@@ -456,7 +456,7 @@ section on Non-Linux Systems.
    Nx586/110 NexGen      81.51   Ron Marsh <rmarsh@plains.nodak.edu>
 </verb>
    
-<sect1>Oddly or faultly configured 486 systems
+<sect1>Oddly or faultily configured 486 systems
 <p>
 <verb>
    System              BogoMips  Reporter
@@ -778,7 +778,7 @@ section on Non-Linux Systems.
    486SX-U5/40 UMC 0c       26.63  Dusan Mihajlovic <zdule@herkules.co.yu>
 </verb>
 
-<sect1>Oddly or faultly configured Pentium systems, or variations
+<sect1>Oddly or faultily configured Pentium systems, or variations
 <p>
 <verb>
    System                BogoMips  Reporter
@@ -937,6 +937,7 @@ section on Non-Linux Systems.
 *  Pentium/60              119.60  Luis Miguel Bruga <lmburga@ieee.org>
    Centaur C6-2/233        154.83  Joe Noble <noble@flashman.com>
 *  Pentium/100             198.66  Patrick Nichols <pat@humbug.org.au>
+*  Pentium/166             332.60  Electra Flarefire <bcrowe@optushome.com.au>
 *  Centaur C6-2/200        398.13  Paolo Cravero <cravero@athena.polito.it>
 </verb>
 
@@ -1042,6 +1043,7 @@ section on Non-Linux Systems.
    Pentium II/466          462.03  Bjorn Lindgren <bjorn@chiba.cx>
    Pentium II/504 overcl   502.99  David Hand <dhand@best.com>
    Pentium II/515          514.46  NN <luckydaze@netzero.net>
+*  Pentium II/272          542.31  Ton <ton@somedomain.com>
 *  Pentium II/350          699.60  Teun Warnaar <tat@dds.nl>
 *  Pentium II/350          699.50  Jan <jan-bruchsal@gmx.net>
 *  Pentium II/400          794.62  Mark Dickie <mark@dickie29.freeserve.co.uk>
@@ -1082,6 +1084,7 @@ section on Non-Linux Systems.
 *  Pentium III/700        1441.79  <a.giachino@ekkinc.com>
 *  Pentium III/730        1461.45  Timm Murray <admin@madtimes.com>
 *  Pentium III/800        1592.52  Slawomir Axzkowski <slawek@talex.com.pl>
+*  Pentium III/866        1723.60  Rob Farrell <rpf@speakeasy.net>
 </verb>
 
 <sect1>Normal Pentium variations: Cyrix, AMD
@@ -1214,6 +1217,7 @@ section on Non-Linux Systems.
    AMD K6-2/338 overcl     675.02  Nicola Fabiano <mx8644@mclink.it>
    AMD K6-2/350            699.60  Juan Domenech <domenech@mail.seric.es>
    AMD K6-2/350 3D         699.60  Mirko Schur <mschur@t-online.de>
+   AMD K6-2/350            699.60  Craig <craig@pop.uky.edu>
    AMD K6-2/350 3D         699.60  D. Breuer <dirk.breuer@post.rwth-aachen.de>
    AMD K6-2/366            732.36  Risto A. Paju <rp241@cam.ac.uk>
    AMD K6-2/366            734.00  Alex Montaron <canal@multimania.com>
@@ -1246,11 +1250,17 @@ section on Non-Linux Systems.
    AMD K6-2/455 3D overcl  914.23  Graham Reed <grwr@ssm.ca>
    AMD K6-2/475 laptop     943.72  Chris Matthews <chris@masc.ca>
    AMD K6-2/475 overcl     950.27  Willow <el-baul@ole.com>
+   AMD K6-2/475 overcl     950.27  Craig <craig@pop.uky.edu>
    AMD K6-2/500            999.42  Jon Berlin <jberlin@worldbank.org>
    AMD K6-2/500 3D         999.42  Laurent <blackm@pop.multimania.com>
    AMD K6-2/500            999.42  Robert <robert@mrcomputers.net>
    AMD K6-2/550 3D        1101.00  Jon Berlin <jberlin@worldbank.org>
    AMD K6-2/550           1101.00  James Yang <jamesy@no-email>
+   AMD K6-2 550           1101.00  Hugh Wilson <hugh.e.wilson@gm.com>
+
+   AMD Duron/650          1294.34  Levi Ramsey <lramsey@student.umass.edu>
+   AMD Duron/700          1395.92  N. Fabiano <nicola.fabiano@pg.infn.it>
+   AMD Duron/700          1399.19  Stuart Trusty <stuart@linuxlabs.com>
 
    AMD K7/500              498.07  Ludwig <cludwig@informatik.uni-tuebingen.de>
    AMD K7/550              548.86  Kieffer <Jerome.KIEFFER@crans.ens-cachan.fr>
@@ -1268,12 +1278,11 @@ section on Non-Linux Systems.
 *  AMD K7/650             1297.61  Travis Brown <tfb999@yahoo.com>
 *  AMD Athlon/700         1387.51  Bradley Lawrence <cecil@niagara.com>
 *  AMD Athlon/700         1395.92  Joop Stakenborg <aba@casema.net>
+*  AMD Athlon/700         1395.92  Martin Kamin <kamin@atlas.cz>
 *  AMD Athlon/700         1412.30  Ulf Bartelt <ult@twc.de>
+)  AMD Athlon/750         1494.22  A Galinovic <thehack@fly.srk.fer.hr>
 *  AMD K7/750             1500.30  W Canaday <rgabill@ameritech.net>
 *  AMD Athlon/800         1605.63  Robert A. Morris <ramorris@yifan.net>
-
-   AMD Duron/700          1395.92  N. Fabiano <nicola.fabiano@pg.infn.it>
-   AMD Duron/700          1399.19  Stuart Trusty <stuart@linuxlabs.com>
 </verb>
 
 <sect1>Normal Alpha systems 
@@ -1285,7 +1294,7 @@ section on Non-Linux Systems.
    21064/150 Jensen        149.49  J.L. Brothers <brothers@halcyon.com>
    21064/150 Jensen        148.89  Martin Osterman <ost@comnets.rwth-aachen.de>
 
-   21064A/233 AS225 Avanti 228.58  Roberto Giungato <giungator@acm.org>
+   21064A/233 AS225 Avanti 228.58  Roberto Giungato <r.giungato@computer.org>
    21064A/233 Avanti       230.16  Rich Griswold <rgriswold@us.ibm.com>
    21064A/275 Cabriolet    271.58  Michal Jaegermann <michal@phys.ualberta.ca>
    21064A/275 Cabriolet    272     Linus Torvalds <torvalds@cc.helsinki.fi>
@@ -1450,6 +1459,7 @@ section on Non-Linux Systems.
 
    Sparc Ultra I/143       278.00  Helmut <helmut@cancon.com>
    Sparc Ultra I sun4u     284.05  Iban Cardona <icc@seric.es>
+   Sparc Ultra I sun4u     333.41  Roberto Giungato <r.giungato@computer.org>
    Sparc Ultra II/270      539.03  Pieter Krul <pieter@dare.demon.nl>
    Sparc Ultra II/360      719.26  Bjoern Augustsson <d3august@dtek.chalmers.se>
 
@@ -1590,7 +1600,7 @@ section on Non-Linux Systems.
    SMP2 Celeron/400        798.21  Stefan Onderka <nop@gameart.com>
    SMP2 Celeron/450        894.57  Stephan Eisler <stephan@lingo.gun.sub.org>
    SMP2 Celeron/500        999.42  Ingimar Rovertsson <iar@skyrr.is>
-   SMP2 Celeron/500        999.42  Rob Farrell <rpf@home.com>
+   SMP2 Celeron/500        999.42  Rob Farrell <rpf@speakeasy.net>
    SMP2 Celeron/515 overc 1028.92  Ryan Werber <rwerber@ctel.net>
    SMP2 Celeron/550 overc 1101.00  Olof Zachrisson <eraolza@ks.ericsson.se>
    SMP2 Celeron/550 overc 1101.00  John Katagawa <dhc@50k.com>
@@ -1610,10 +1620,14 @@ section on Non-Linux Systems.
    SMP2 Pentium III/650   1300.88  Dan Kegel <dank@alumni.caltech.edu>
    SMP4 Pentium III/450   1794.00  Glenn Stone <glenns@ami.com>
    SMP4 Pentium III/550   2195.46  Yan P. Yuan <Yanping.Yuan@EMBL-Heidelberg.de>
+*  SMP2 Pentium III/600   2401.89  Shawn Hicks <shicks@impulse.net>
+*  SMP2 Pentium III/600   2401.89  John Wiggins <jwiggins@csce.uark.edu>
 *  SMP2 Pentium III/750   3001.55  Jesse Tie Ten Quee <tie@mountlinux.com>
    SMP8 Pentium III/500   3996.06  Richard Langis <rlangis@primux.geekfest.net>
 
    SMP2 Sparc SS/50         99.84  Dimitris Tsifakis <sv1det@freemail.gr>
+
+   SMP31 EV67/731 Wildf. 46170.90  Peter Rival <frival@zk3.dec.com>
 </verb>
 
 <sect1>Non-Linux systems (reference only)
@@ -1714,17 +1728,14 @@ section on Non-Linux Systems.
 
 <sect>Signature
 <p>
-I never think that having three children is any sort of a burden, 
-quite contrarily.  Of course, we did notice that having three kids around can 
-require some proper regulating and scheduling, all quite acceptable 
-and doable.  Last week both <htmlurl url="mailto:roderick@clifton.hobby.nl" 
-name="Roderick"> and his sister <htmlurl url="mailto:isolde@clifton.hobby.nl" 
-name="Isolde"> stayed at their grandparents for a couple of nights. That
-left Mum and Dad with ONLY baby <htmlurl url="mailto:daphne@clifton.hobby.nl" 
-name="Daphne">, now just one year old. This led us to believe that we were 
-back in bachelor days again! What freedom to do and go as you please. 
-Fortunately, this 'euphoria' didn't last long: we wouldn't want to miss them 
-for all the money in the world.
+This next week 
+<htmlurl url="mailto:roderick@clifton.hobby.nl" name="Roderick">, and his 
+sisters <htmlurl url="mailto:isolde@clifton.hobby.nl" name="Isolde"> and
+<htmlurl url="mailto:daphne@clifton.hobby.nl" name="Daphne"> have 
+autumn vacation. They typically 'have nothing to do,' therefore 
+'must have' their father's PC for playing Sesamestreet and 
+Busytown games. Oh, well, at least I have the PC during the working
+days, for working.
 
 Met vriendelijke groeten, Wim 'Dad' van Dorst.
 <verb>
diff --git a/LDP/howto/linuxdoc/VPN-Masquerade-HOWTO.sgml b/LDP/howto/linuxdoc/VPN-Masquerade-HOWTO.sgml
index f7c45f5b..14b40ce3 100644
--- a/LDP/howto/linuxdoc/VPN-Masquerade-HOWTO.sgml
+++ b/LDP/howto/linuxdoc/VPN-Masquerade-HOWTO.sgml
@@ -4,15 +4,15 @@
 <title>Linux VPN Masquerade HOWTO
 <author>John D. Hardin <tt><htmlurl url="mailto:jhardin@wolfenet.com"
 name="&lt;jhardin@wolfenet.com&gt;"></tt> 
-<date>v2.2, 9 September 1999
+<date>$Revision$ $Date$
 
 <abstract>
-This document describes how to configure a Linux firewall to masquerade
+How to configure a Linux firewall to masquerade
 IPsec- and PPTP-based Virtual Private Network traffic, allowing you to
 establish a VPN connection without losing the security and flexibility of
 your Linux firewall's internet connection and allowing you to make
 available a VPN server that does not have a registered internet IP address.
-Information on configuring the VPN client and server is also given.
+Brief information on configuring the VPN client and server is also given.
 </abstract>
 
 <toc>
@@ -27,14 +27,17 @@ Information on configuring the VPN client and server is also given.
 <p>
 This document describes how to configure masquerading of IPsec and PPTP VPN
 traffic. SSH-based VPNs (such as that sold by F-Secure and outlined in the
-<htmlurl url="http://metalab.unc.edu/LDP/HOWTO/mini/VPN.html"
-name="VPN mini-HOWTO">) are based on standard TCP traffic and do not need
-any special kernel modifications.
+<htmlurl url="http://www.linux.org/help/ldp/mini/VPN.html" name="VPN mini-HOWTO">)
+are based on standard TCP traffic and do not need any special kernel
+modifications.
 
 <p>
 VPN Masquerade allows you to establish one or more IPsec and/or PPTP
-sessions to internet-accessible VPN servers via your Linux internet
-firewall without forcing you to connect to your ISP directly from the VPN
+sessions to internet-accessible VPN servers via your Linux
+<htmlurl url="http://foldoc.doc.ic.ac.uk/foldoc/foldoc.cgi?firewall+machine"
+name="internet firewall"> without forcing you to connect to your
+<htmlurl url="http://foldoc.doc.ic.ac.uk/foldoc/foldoc.cgi?internet+service+provider" name="ISP">
+directly from the VPN
 client system - thus retaining all of the benefits of your Linux internet
 firewall. It also allows you to set up a VPN server with a Private Network
 IP address (as described in <htmlurl url="http://andrew2.andrew.cmu.edu/rfc/rfc1918.html"
@@ -45,29 +48,54 @@ dial-up link.
 <p>
 It is strongly recommended that you understand, configure and test regular
 IP Masquerading before you attempt to set up VPN masquerading. Please see
-the <htmlurl url="http://members.home.net/ipmasq/ipmasq-HOWTO-1.65.html"
+the <htmlurl url="http://members.home.net/ipmasq/ipmasq-HOWTO-1.82.html"
 name="IP Masquerade HOWTO"> and the IP Masquerade Resource page at
-<url url="http://ipmasq.cjb.net/"> before proceeding.
+<url url="http://ipmasq.cjb.net/"> before proceeding. Planning and setting
+up your VPN and firewall is beyond the scope of this document. Here are
+some resources:
+<itemize>
+<item><url url="http://www.linux.org/help/ldp/howto/Firewall-HOWTO.html">
+<item><url url="http://hal2000.hal.vein.hu/~mag/linux-security/VPN-HOWTO.html">
+</itemize>
 <p>
 The patch for the 2.0.x-series kernels works well on Linux kernel version
 2.0.36, has been incorporated into the 2.0.37 release, may work on versions
 earlier than 2.0.36, and should work on Linux kernels up to about version
 2.1.102. The IP masquerade code in the kernel was restructured at about
 version 2.1.103, requiring a different patch for the 2.1.105+ and 2.2.x
-series of kernels. A patch is available for kernels from 2.2.5 to 2.2.12,
+series of kernels. A patch is available for kernels from 2.2.5 to 2.2.17,
 and it may work on earlier kernels.
 <p>
 
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
 <sect1> Feedback, Credits &amp; Resources
 <p>
+The home page for the Linux VPN Masquerade kernel patches
+is <url url="http://www.impsec.org/linux/masquerade/ip_masq_vpn.html">
+<p>
 Please feel free to send any feedback or comments regarding this document
 to me at <htmlurl url="mailto:jhardin@wolfenet.com"
-name="&lt;jhardin@wolfenet.com&gt;">.
+name="&lt;jhardin@wolfenet.com&gt;">. The current version can be found at:
+<itemize>
+<item> HTML: <url url="ftp://ftp.rubyriver.com/pub/jhardin/masquerade/VPN-howto/VPN-Masquerade.html">
+<item> Postscript: <url url="ftp://ftp.rubyriver.com/pub/jhardin/masquerade/VPN-howto/VPN-Masquerade.ps.gz">
+<item> SGML source: <url url="ftp://ftp.rubyriver.com/pub/jhardin/masquerade/VPN-Masquerade.sgml">
+</itemize>
+If you are working with a kernel whose version number is higher than any
+mentioned in this document, <em>please</em> see if there is an updated
+version of the HOWTO at the above site before contacting me directly.
+<p>
+It can also be found via the
+<htmlurl url="http://metalab.unc.edu/LDP/" name="Linux Documentation Project">'s
+<htmlurl url="http://metalab.unc.edu/LDP/HOWTO/" name="HOWTO repository"> and in the
+<tt><htmlurl url="file:/usr/doc/HOWTO/" name="/usr/doc/HOWTO/"></tt>
+directory on your nearest Linux system. These copies are not directly
+updated by me, so they may be somewhat out of date.
+<p>
+I personally have experience with masquerading IPsec and PPTP clients
+running on MS W'98 and NT, configuring a registered-IP PPTP server, and
+using PPTP for network-to-network routing.
 <p>
-I personally have experience with masquerading a MS NT-Server-based
-PPTP client, configuring a registered-IP PPTP server, and using PPTP for
-network-to-network routing.
 The information on masquerading a Private-IP PPTP server is from
 discussions with
 Len Bayles <htmlurl url="mailto:len@isdi.com" name="&lt;len@isdi.com&gt;">,
@@ -75,26 +103,19 @@ Simon Cocking <htmlurl url="mailto:simon@ibs.com.au" name="&lt;simon@ibs.com.au&
 and
 C. Scott Ananian <htmlurl url="mailto:cananian@lcs.mit.edu" name="&lt;cananian@lcs.mit.edu&gt;">.
 <p>
-The current version of this document can be found at
-<url url="ftp://ftp.rubyriver.com/pub/jhardin/masquerade/VPN-Masquerade.sgml"> - it
-and other formats (such as HTML) can be found via the
-<htmlurl url="http://metalab.unc.edu/LDP/" name="Linux Documentation
-Project">'s <htmlurl url="http://metalab.unc.edu/LDP/HOWTO/"
-name="HOWTO repository"> and in the <tt><htmlurl url="file:/usr/doc/HOWTO/"
-name="/usr/doc/HOWTO/"></tt> directory on your nearest Linux system.
-<p>
-The home page for the Linux VPN Masquerade kernel patch
-is <url url="http://www.wolfenet.com/~jhardin/ip_masq_vpn.html">
-<p>
-The home page for the PPTP-only Masquerade kernel patch for the 2.1.105+ and 2.2.x kernel
-series is <url url="http://bmrc.berkeley.edu/people/chaffee/linux_pptp.html">.
+The home page for the PPTP-only Masquerade kernel patch for the 2.1.105+
+and early 2.2.x kernel series is
+<url url="http://bmrc.berkeley.edu/people/chaffee/linux_pptp.html">.
 <p>
 The home page for the <tt>ipportfw</tt> port-forwarding kernel patch and
-configuration tool is
-<url url="http://www.ox.compsoc.org.uk/&tilde;steve/portforwarding.html">.
+configuration tool for 2.0.x kernels is
+<url url="http://www.ox.compsoc.org.uk/~steve/portforwarding.html">.
+Port forwarding is built into the 2.2.x kernel, and the <tt>ipmasqadm</tt>
+configuration tool for controlling 2.2.x port forwarding can be obtained at
+<url url="http://juanjox.kernelnotes.org/">.
 <p>
 The home page for the <tt>ipfwd</tt> generic IP redirector is
-<url url="http://www.pdos.lcs.mit.edu/&tilde;cananian/Projects/IPfwd/">.
+<url url="http://www.pdos.lcs.mit.edu/~cananian/Projects/IPfwd/">.
 <p>
 Profuse thanks to Gordon Chaffee
 <htmlurl url="mailto:chaffee@cs.berkeley.edu" name="&lt;chaffee@cs.berkeley.edu&gt;">
@@ -114,29 +135,38 @@ can be found at
 <url url="http://www.wolfenet.com/~jhardin/ipfwadm/invocation.html">
 <p>
 The home page for Linux FreeS/WAN (IPsec for Linux) is
-<url url="http://www.xs4all.nl/&tilde;freeswan">
+<url url="http://www.xs4all.nl/~freeswan/"> - this is the preferred Linux
+VPN solution.
 <p>
-The home page for the Linux PPTP project is
-<url url="http://www.pdos.lcs.mit.edu/~cananian/Projects/PPTP"> and a patch
-to add PPTP server capability is available at
-<url url="http://debs.fuller.edu/cgi-bin/display?list=pptp&amp;msg=222">
-<p>
-A second Linux PPTP server called PoPToP is available at
-<url url="http://www.moretonbay.com/vpn/pptp.html">
+A native Linux PPTP server called PoPToP is available at
+<url url="http://www.moretonbay.com/vpn/pptp.html"> - for the most
+up-to-date information about PPTP on Linux, go there.
 <p>
 Paul Cadach
 <htmlurl url="mailto:paul@odt.east.telecom.kz" name="&lt;paul@odt.east.telecom.kz&gt;">
 has made patches that add MS-CHAP-v2, MPPE and Multilink support to Linux pppd. See
 <url url="ftp://ftp.east.telecom.kz/pub/src/networking/ppp/ppp-2.3.5-my.tgz"> for MS-CHAP and MPPE, and
 <url url="ftp://ftp.east.telecom.kz/pub/src/networking/ppp/multilink/ppp-2.3.5-mp.tgz"> for Multilink.
+Another (possibly related) set of pppd patches are available at the PoPToP download site at
+<url url="http://www.moretonbay.com/vpn/download_pptp.html">.
+<p>
+The home page for the original Linux PPTP project is
+<url url="http://www.pdos.lcs.mit.edu/~cananian/Projects/PPTP"> and a patch
+to add PPTP server capability to it is available at
+<url url="http://debs.fuller.edu/cgi-bin/display?list=pptp&amp;msg=222">
+<p>
+Thanks to Eric Raymond for maintaining <htmlurl
+url="http://www.tuxedo.org/jargon/" name="the Jargon File">, and Denis
+Howe for <htmlurl url="http://foldoc.doc.ic.ac.uk/" name="The Free On-line
+Dictionary of Computing">.
 <p>
 
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
 <sect1> Copyright &amp; Disclaimer
 <p>
-This document is copyright &copy; 1999 by John D. Hardin.
-Permission is granted to redistribute it under the terms of the GNU General
-Public License. 
+This document is copyright &copy; 1999-2000 by John D. Hardin.
+Permission is granted to redistribute it under the terms of the LDP
+License, available at <url url="http://www.linuxdoc.org/COPYRIGHT.html"> 
 <p>
 The information presented in this document is correct to the best of my
 knowledge. IP Masquerading is <em>experimental</em>, and it is possible
@@ -164,7 +194,8 @@ In other words, take sensible precautions.
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
 <sect1> What is a VPN?
 <p>
-A Virtual Private Network, or &quot;VPN&quot;, is a tunnel that carries
+A <htmlurl url="http://foldoc.doc.ic.ac.uk/foldoc/foldoc.cgi?VPN"
+name="Virtual Private Network">, or &quot;VPN&quot;, is a tunnel that carries
 private network traffic from one endpoint system to another over a public
 network (such as the Internet) without the traffic being aware that there
 are intermediate hops between the endpoints, or the intermediate hops being
@@ -175,22 +206,23 @@ enhanced performance and some measure of security.
 The &quot;Virtual&quot; part stems from the fact that you are constructing
 a private link over a public network, rather than actually buying a direct
 hardwired link over leased lines. The VPN allows you to pretend you are
-using a leased line to communicate between the endpoints.
+using a leased line or direct telephone call to communicate between the endpoints.
 <p>
 You may find the VPN FAQ at
-<url url="http://kubarb.phsx.ukans.edu/&tilde;tbird/FAQ.html">
+<url url="http://kubarb.phsx.ukans.edu/~tbird/vpn/FAQ.html">
 informative.
 <p>
 
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
 <sect1> What is IPsec?
 <p>
-IPsec is a set of standard protocols for implementing secure communications
+<bf><htmlurl url="http://foldoc.doc.ic.ac.uk/foldoc/foldoc.cgi?IPsec" name="IPsec"></bf>
+is a set of standard protocols for implementing secure communications
 and encryption key exchange between computers. It can be used to implement
 a VPN.
 <p>
 An IPsec VPN generally consists of two communications channels between the
-the endpoints: a key-exchange channel over which authentication and
+endpoint hosts: a key-exchange channel over which authentication and
 encryption key information is passed, and one or more data channels over
 which private network traffic is carried.
 <p>
@@ -199,30 +231,39 @@ data channels carrying the traffic between the client and server use IP
 protocol number 50 (ESP).
 <p>
 More information is available in F-Secure's IPsec FAQ at
-<url url="http://www.data-fellows.com/f-secure/support/vpn-plus/faq/techfaq.htm">,
+<url url="http://www.Europe.F-Secure.com/support/vpn+/faq/techfaq.html">,
 and in
 <htmlurl url="http://andrew2.andrew.cmu.edu/rfc/rfc2402.html" name="RFC2402">
-(the AH protocol),
+(the AH protocol, IP protocol number 51),
 <htmlurl url="http://andrew2.andrew.cmu.edu/rfc/rfc2406.html" name="RFC2406">
-(the ESP protocol),
+(the ESP protocol, IP protocol number 50),
 and
 <htmlurl url="http://andrew2.andrew.cmu.edu/rfc/rfc2408.html" name="RFC2408">
 (the ISAKMP key-exchange protocol).
 <p>
-Important note: If your VPN is based on the AH protocol, it cannot be
-masqueraded. The AH protocol specifies a cryptographic checksum across
-portions of the IP header, including the IP addresses. IP Masquerade is
+IPsec is a peer-to-peer protocol. However, since most people will be
+exposed to it in the form of an originate-only Windows client being used to
+access a central network security gateway, &quot;client&quot; will be used to
+refer to the endpoint host that the user is sitting in front of and
+&quot;server&quot; will be used to refer to the central network security
+gateway.
+<p>
+Important note: If your VPN is based on the AH protocol (including AH+ESP), it
+cannot be masqueraded. The AH protocol specifies a cryptographic checksum
+across portions of the IP header, including the IP addresses. IP Masquerade is
 implemented by modifying the source IP address for outbound packets and the
 destination IP address for inbound packets. Since the masquerading gateway
 cannot participate in the encryption key exchange, it cannot generate the
 correct cryptographic checksums for the modified IP headers. Thus the
 modified IP packets will be discarded by the recipient as invalid, because
 they fail the cryptographic checksum test.
+<p>
 
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
 <sect1> What is PPTP?
 <p>
-<bf>PPTP</bf> stands for <em><bf>P</bf></em>oint-to-<em><bf>P</bf></em>oint
+<bf><htmlurl url="http://foldoc.doc.ic.ac.uk/foldoc/foldoc.cgi?PPTP" name="PPTP"></bf>
+stands for <em><bf>P</bf></em>oint-to-<em><bf>P</bf></em>oint
 <em><bf>T</bf></em>unnelling <em><bf>P</bf></em>rotocol. It is a
 Microsoft-proposed protocol for implementing a VPN.
 <p>
@@ -242,17 +283,31 @@ options negotiated over the tunnel by PPP control whether the data is
 compressed and/or encrypted, thus PPTP itself has nothing to do with
 encryption.
 <p>
-The details of the PPTP protocol are documented at
-<url url="http://www.ietf.org/internet-drafts/draft-ietf-pppext-pptp-08.txt">.
+The details of the PPTP protocol are documented in
+<htmlurl url="http://andrew2.andrew.cmu.edu/rfc/rfc2637.html"
+name="RFC2637">.
 <p>
 Microsoft's implementation of the PPTP protocol is not considered very
-secure. If you're interested in the details, here are three seperate analyses:
+secure. If you're interested in the details, here are three separate analyses:
 <p>
 <url url="http://www.counterpane.com/pptp.html">
 <p>
 <url url="http://www.geek-girl.com/bugtraq/1999_1/0664.html">
 <p>
-<url url="http://oliver.efri.hr/&tilde;crv/security/bugs/NT/pptp2.html">
+<url url="http://oliver.efri.hr/~crv/security/bugs/NT/pptp2.html">
+<p>
+
+<!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
+<sect1> What is FWZ?
+<p>
+<bf>FWZ</bf> is a proprietary encryption protocol developed by 
+<htmlurl url="http://www.checkpoint.com/" name="Check Point Software Technologies">.
+It is used in VPNs that are built around their Firewall-1 product.
+<p>
+A Checkpoint-based firewall can be configured in several modes. The
+&quot;FWZ Encapsulation&quot; mode <em>cannot</em> be masqueraded. The
+&quot;IKE&quot; mode, which uses standard IPsec protocols, can be
+masqueraded with minor configuration changes on the VPN gateway.
 <p>
 
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
@@ -280,11 +335,11 @@ even if the desktops do not have registered IP addresses.
 Yes, though there may occasionally be minor problems.
 <p>
 The IPsec protocols define a method for identifying the traffic streams
-called the Security Parameters Index (&quot;SPI&quot;). Unfortunately the
-SPI used by outbound traffic is different from the SPI used by inbound
-traffic, and there is no other identifying information available that is
-not encrypted, so association of the inbound and outbound data streams is
-difficult and not perfectly reliable.
+called the <em>Security Parameters Index</em> (&quot;SPI&quot;).
+Unfortunately the SPI used by outbound traffic is different from the SPI
+used by inbound traffic, and there is no other identifying information
+available that is not encrypted, so association of the inbound and outbound
+data streams is difficult and not perfectly reliable.
 <p>
 IPsec Masquerade attempts to associate inbound and outbound ESP traffic by
 serializing new connections. While this has worked well in testing, it
@@ -296,7 +351,7 @@ remote IPsec host simultaneously.
 It is also assumed that should this association scheme fail to associate
 the traffic streams correctly, the IPsec hosts themselves will discard the
 incorrectly routed traffic because it will have the wrong SPI values. This
-is required by the IPsec RFC.
+is required by the IPsec RFCs.
 <p>
 These problems could be eliminated if there was some way to sniff the new
 SPI values from the ISAKMP key exchange before any ESP traffic appears, but
@@ -311,6 +366,7 @@ See the IPsec technical notes at the end of the document for more details.
 <p>
 
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
+<label id="multiclientpptp">
 <sect1> Can several clients on my local network use PPTP simultaneously?
 <p>
 Yes.
@@ -320,6 +376,16 @@ order to distinguish between multiple data streams from the same server.
 PPTP masq with Call ID masq enabled will support many concurrent masqueraded
 sessions with no restrictions on which server a client can call.
 <p>
+<htmlurl url="http://andrew2.andrew.cmu.edu/rfc/rfc2637.html" name="The PPTP RFC">
+specifies in section 3.1.3 that there may only be one control channel
+connection between two systems. This <em>should</em> mean that you can only
+masquerade one PPTP session at a time with a given remote server, but in
+practice the MS implementation of PPTP does not enforce this, at least not as
+of NT 4.0 Service Pack 4. If the PPTP server you're trying to connect to only
+permits one connection at a time, it's following the protocol rules properly.
+Note that this does not affect a masqueraded server, only multiple masqueraded
+clients attempting to contact the same remote server.
+<p>
 For another alternative, see the next question...
 <p>
 
@@ -336,8 +402,9 @@ you're only using it to route encrypted traffic.
 If you cannot install a Linux or NT-based VPN client, then you'll have to
 enable PPTP Call-ID masquerade if you are using PPTP, and install VPN
 client software on every system you want to provide access for. This is
-inefficient, aesthetically revolting and a security weakness, but it's
-cheaper than licensing NT.
+inefficient, aesthetically revolting, a security weakness, and may not work
+if the PPTP server correctly implements the protocol, but it's cheaper
+than licensing NT.
 <p>
 Network-to-network routing this way works very well. This is how I have my
 home network set up for telecommuting. It does require a little more
@@ -361,6 +428,7 @@ even if you only have one assigned IP address. This should work even if
 your IP address is dynamically assigned: you would publicize the IP address
 for clients through the use of a third-party dynamic DNS service such as
 that provided by <htmlurl url="http://www.ddns.org/" name="DDNS.ORG">
+or <htmlurl url="http://www.cjb.net/" name="CJB.NET">
 and configure the clients to connect to a system named
 <tt>our-company.ddns.org</tt> or something similar. Note that this is a
 security risk, because it is possible for an incorrect IP address to be
@@ -372,13 +440,13 @@ registering a different IP address under the system name.
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
 <sect1> Why patch the Linux kernel?
 <p>
-The largest problem in masquerading VPN traffic is that the stock 2.0.x
-Linux kernel has no special awareness of IP protocols other than TCP, UDP
-and ICMP.
+The largest problem in masquerading VPN traffic is that the stock 
+Linux IP masquerade has no special awareness of IP protocols other than
+TCP, UDP and ICMP.
 <p>
 All IP traffic may be forwarded and filtered by IP address, but
-filtering on or masquerading IP protocols other than TCP, UDP and ICMP
-requires modifying the kernel.
+masquerading IP protocols other than TCP, UDP and ICMP requires modifying the
+kernel.
 <p>
 The PPTP control channel is plain TCP and requires no special setup beyond
 letting it through the firewall and masquerading it.
@@ -387,34 +455,38 @@ Masquerading the IPsec and PPTP data channels requires a modification that
 adds support for the ESP and GRE protocols to the masquerading code, and
 masquerading the ISAKMP key exchange protocol requires a modification that
 prevents masquerade from altering the UDP source port number and adds
-tracking of the ISAKMP cookie values.
+tracking of the ISAKMP cookie values instead of the port number.
 <p>
 
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
 <sect1> Current Status
 <p>
 The 2.0.x kernel patch works on kernel 2.0.36 and is incorporated into the
-standard 2.0.37 kernel release. It may work on earlier kernels but I have
-not tested it, and I recommend you upgrade to the latest kernel anyway for
-security reasons if you are running a kernel that old.
+standard 2.0.37 and higher kernel releases. It may work on earlier kernels but
+I have not tested it, and I recommend you upgrade to kernel 2.0.38 anyway
+for security reasons if you are running an older kernel.
 <p>
-The 2.2.x kernel patch works on kernels from 2.2.5 to 2.2.12 and may work
-on earlier kernels, but that has not been tested. It will be submitted for
-inclusion in the standard 2.2.13 release if all goes well.
+The 2.2.x kernel patch works on kernels from 2.2.5 to 2.2.17 and may work
+on earlier kernels, but that has not been tested. It has been submitted for
+inclusion in the standard 2.2.18 release.
+<p>
+I don't have the resources to follow the development kernels, so at this
+time no work on VPN Masquerade for 2.3.x or 2.4.x has taken place. If you
+know someone who <em>is</em> working on this, please let me know.
 <p>
 The 2.0.x kernel patch has been tested and works on x86 and Sparc systems,
-and the 2.2.x kernel patch has been tested and works on x86 systems,
+and the 2.2.x kernel patch has been tested and works on x86 and PowerPC systems,
 but there should be no major problems in porting to other architectures. I
-believe the architecture dependencies are only in endian-ness within the
+believe the architecture dependencies would only be in endian-ness within the
 bitmaps in the GRE header definition used to format debugging log messages.
 If anyone ports this to a non-Intel architecture I'd appreciate hearing
 about it so I can merge any changes into the master copy.
 <p>
-A PPTP-only kernel patch for the 2.1.105+ and 2.2.x kernel series is
+A PPTP-only kernel patch for the 2.1.105+ and early 2.2.x kernels is
 available at <url url="http://bmrc.berkeley.edu/people/chaffee/linux_pptp.html">.
 <p>
 See the VPN Masquerade home page at
-<url url="http://www.wolfenet.com/~jhardin/ip_masq_vpn.html"> for the status of
+<url url="http://www.impsec.org/linux/masquerade/ip_masq_vpn.html"> for the status of
 the VPN Masq patches, and
 <url url="http://bmrc.berkeley.edu/people/chaffee/linux_pptp.html"> for the
 status of the 2.1.105+/2.2.x PPTP-only Masq patch.
@@ -481,21 +553,20 @@ obtain and install the following two packages:
 To redirect the inbound TCP/UDP traffic (the 1723/tcp PPTP control channel
 or the 500/udp ISAKMP channel), you need the appropriate <tt>ipportfw</tt>
 port-forwarding kernel patch and configuration tool from
-<url url="http://www.ox.compsoc.org.uk/&tilde;steve/portforwarding.html">.
+<url url="http://www.ox.compsoc.org.uk/~steve/portforwarding.html">.
 Port forwarding has been incorporated into the 2.2.x kernel. See <tt>man
-ipmasqadm</tt> for configuration details.
-<p>
-If <tt>ipmasqadm</tt> is not included with your distribution it can be
-obtained at <url url="http://juanjox.linuxhq.com/">
+ipmasqadm</tt> for configuration details. If <tt>ipmasqadm</tt> is not
+included with your distribution it can be obtained at
+<url url="http://juanjox.kernelnotes.org/">.
 <p>
 <item>
 To redirect the initial inbound tunnel traffic (GRE for PPTP and ESP for
-IPsec), you need the <tt>ipfwd</tt> generic-IP proxy from
-<url url="http://www.pdos.lcs.mit.edu/&tilde;cananian/Projects/IPfwd/">.
+IPsec), you need the <tt>ipfwd</tt> generic-IP redirector from
+<url url="http://www.pdos.lcs.mit.edu/~cananian/Projects/IPfwd/">.
 </itemize>
 <p>
-You do not need port forwarding or ipfwd if you are only masquerading
-clients.
+You <em>do not</em> need port forwarding or ipfwd if you are
+masquerading only clients.
 
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
 <sect1> Patching and configuring the 2.0.x kernel for VPN Masquerade support
@@ -507,7 +578,7 @@ sources should be automatically extracted into a directory named
 <tt>/usr/src/linux</tt>.
 <p>
 <item>Configure and test standard IP Masquerading (see the 
-<htmlurl url="http://members.home.net/ipmasq/ipmasq-HOWTO-1.65.html"
+<htmlurl url="http://members.home.net/ipmasq/ipmasq-HOWTO-1.82.html"
 name="IP Masquerade HOWTO">). Doing this will familiarize you with
 recompiling your kernel and introduce you to IP Masquerading in general.
 <p>
@@ -534,11 +605,11 @@ you've saved the appropriate patch in <tt>/usr/src/ip_masq_vpn.patch.gz</tt>.
 <quote><tt>cd /usr/src/linux</tt></quote>
 
 <item>Apply the patch:
-<quote><tt>gzcat ../ip_masq_vpn.patch.gz | patch -l -p0 &gt; vpn-patch.log</tt></quote>
+<quote><tt>zcat ../ip_masq_vpn.patch.gz | patch -l -p0 &gt; vpn-patch.log 2&gt;&amp;1</tt></quote>
 <quote>Note that the options are &quot;dash lowercase L, dash lowercase
-P zero&quot;.</quote> <quote>Also, you may get odd results if you
-change the order of the arguments. Patch seems to be sensitive to the
-order they appear on the command line.</quote>
+P zero&quot;. You may get odd results if you change the order of the arguments,
+as patch seems to be sensitive to the order they appear on the command line.
+</quote>
 
 <item>Check the <tt>vpn-patch.log</tt> file to see if any hunks failed.
 If you get failed hunks, then you probably either omitted the options
@@ -617,10 +688,10 @@ say <em>YES</em> to the following:
   * IP: IPSEC masq table lifetime (minutes)
     - See your network administrator to determine what the
       &quot;rekey interval&quot; or &quot;key lifetime&quot; is set to. The
-      default lifetime of masq table entries is thirty minutes.
-      If your rekey interval is greater than thirty minutes,
-      then you should increase the lifetime to a value slightly
-      greater than the rekey interval.
+      default lifetime of masq table entries is thirty
+      minutes.  If your rekey interval is greater than
+      thirty minutes, then you should increase the lifetime
+      to a value slightly greater than the rekey interval.
 
   * IP: always defragment
     CONFIG_IP_ALWAYS_DEFRAG 
@@ -642,10 +713,10 @@ To determine whether the running kernel includes VPN Masquerade support,
 run the following command:
 <quote>
 <verb>
-grep masq /proc/ksyms
+grep -i masq /proc/ksyms
 </verb>
 </quote>
-Look for the following entries:
+...and look for the following entries:
 <itemize>
 <item>IPsec masquerade: <tt>ip_masq_out_get_isakmp</tt>,
   <tt>ip_masq_in_get_isakmp</tt>, <tt>ip_fw_masq_esp</tt> and
@@ -665,17 +736,26 @@ name="Kernel HOWTO"> for more details on configuring and recompiling your
 kernel.
 <p>
 
+If you are using IPsec masquerade and your system is generating
+General Protection errors (see <tt>/var/log/messages</tt>) or is
+locking up, see the
+<htmlurl url="http://www.impsec.org/linux/masquerade/ip_masq_vpn.html"
+name="VPN Masquerade home page"> for an update. This patch is for
+2.0.38, but should work on earlier kernels. It has been submitted to
+Alan Cox for inclusion in the 2.0.39 kernel.
+<p>
+
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
 <sect1> Patching and configuring the 2.2.x kernel for VPN Masquerade support
 <p>
 <enum>
-<item>Install the kernel source (preferably version 2.2.10 or later), which
+<item>Install the kernel source (preferably version 2.2.17 or later), which
 you can obtain from <url url="http://www.kernel.org/"> or a mirror. The
 sources should be automatically extracted into a directory named
 <tt>/usr/src/linux</tt>.
 <p>
 <item>Configure and test standard IP Masquerading (see the 
-<htmlurl url="http://members.home.net/ipmasq/ipmasq-HOWTO-1.65.html"
+<htmlurl url="http://members.home.net/ipmasq/ipmasq-HOWTO-1.82.html"
 name="IP Masquerade HOWTO">). Doing this will familiarize you with
 recompiling your kernel and introduce you to IP Masquerading in general.
 <p>
@@ -695,11 +775,11 @@ you've saved the appropriate patch in <tt>/usr/src/ip_masq_vpn.patch.gz</tt>.
 <quote><tt>cd /usr/src</tt></quote>
 
 <item>Apply the patch:
-<quote><tt>gzcat ip_masq_vpn.patch.gz | patch -l -p0 &gt; vpn-patch.log</tt></quote>
+<quote><tt>zcat ip_masq_vpn.patch.gz | patch -l -p0 &gt; vpn-patch.log 2&gt;&amp;1</tt></quote>
 <quote>Note that the options are &quot;dash lowercase L, dash lowercase
-P zero&quot;.</quote> <quote>Also, you may get odd results if you
-change the order of the arguments. Patch seems to be sensitive to the
-order they appear on the command line.</quote>
+P zero&quot;. You may get odd results if you change the order of the arguments,
+as patch seems to be sensitive to the order they appear on the command line.
+</quote>
 <quote>Also note that the directory you run the patch command in is
 different for the 2.2.x kernel patch</quote>
 
@@ -712,6 +792,8 @@ from the backup and try again.
 <item>If you are masquerading a VPN server you do <em>not</em> need the
 <tt>ipportfw</tt> patch as port forwarding is now built-in. See the
 <tt>ipmasqadm</tt> man page for more details.
+If <tt>ipmasqadm</tt> is not included with your distribution it can be
+obtained at <url url="http://juanjox.kernelnotes.org/">.
 <p>
 
 <item>Configure your kernel and select the following options -
@@ -736,7 +818,10 @@ say <em>YES</em> to the following:
 
   * IP: always defragment
     CONFIG_IP_ALWAYS_DEFRAG 
-    - Required for masquerading
+    - Required for masquerading. This may or may not
+      be in your kernel config. If not, you should
+      run this in your startup scripts:
+        echo 1 > /proc/sys/net/ipv4/ip_always_defrag
 
   * IP: masquerading (EXPERIMENTAL) 
     CONFIG_IP_MASQUERADE 
@@ -765,18 +850,35 @@ say <em>YES</em> to the following:
   * IP: IPsec masq table lifetime (minutes)
     - See your network administrator to determine what the
       &quot;rekey interval&quot; or &quot;key lifetime&quot; is set to. The default
-      lifetime of masq table entries is thirty minutes.
-      If your rekey interval is greater than thirty minutes,
-      then you should increase the lifetime to a value slightly
-      greater than the rekey interval.
+      lifetime of masq table entries is thirty minutes. If
+      your rekey interval is greater than thirty minutes,
+      then you should increase the lifetime to a value
+      slightly greater than the rekey interval.
 
   * IP: Enable parallel sessions (possible security risk - see help)
     CONFIG_IP_MASQUERADE_IPSEC_PAROK
-    - See the IPsec masquerade technical notes and
-      special security considerations section of the HOWTO for
+    - See the IPsec masquerade technical notes and special
+      security considerations section of the HOWTO for
       security considerations to be aware of when
-      masquerading IPsec traffic. If you are only masquerading
-      one IPsec client this setting has no effect.
+      masquerading IPsec traffic. If you are only
+      masquerading one IPsec client this setting has no
+      effect.
+
+</verb></tscreen>
+
+Say <em>NO</em> to the following:
+
+<tscreen><verb>
+  * IP: GRE tunnels over IP
+    CONFIG_NET_IPGRE
+    - This, confusingly, has *NOTHING* to do with PPTP.
+      It enables support for GRE tunnels as used by Cisco
+      routers. The fact that you see this option does not
+      imply that PPTP support is available. You still need
+      to apply the VPN Masquerade patch if the PPTP options
+      listed above do not appear when you are configuring
+      your kernel. DO NOT enable this unless you are setting
+      up a GRE tunnel to a Cisco router.
 
 </verb></tscreen>
 
@@ -794,22 +896,37 @@ To determine whether the running kernel includes VPN Masquerade support,
 run the following command:
 <quote>
 <verb>
-grep masq /proc/ksyms
+grep -i masq /proc/ksyms
 </verb>
 </quote>
-Look for the following entries:
+...and look for the following entries:
 <itemize>
-<item>IPsec masquerade: <tt>ip_fw_masq_esp</tt> and
-  <tt>ip_fw_demasq_esp</tt>
-<item>PPTP masquerade: <tt>ip_fw_masq_gre</tt> and <tt>ip_fw_demasq_gre</tt>
+<item>IPsec masquerade: <tt>ip_masq_esp</tt> and <tt>ip_demasq_esp</tt>
+<item>PPTP masquerade: <tt>ip_masq_pptp_tcp</tt> and <tt>ip_demasq_pptp_tcp</tt>
+</itemize>
+Or run:
+<quote>
+<verb>
+lsmod
+</verb>
+</quote>
+...and look for the following entries:
+<itemize>
+<item>IPsec masquerade: <tt>ip_masq_ipsec</tt>
+<item>PPTP masquerade: <tt>ip_masq_pptp</tt>
 </itemize>
 
 If you don't see these entries, VPN Masquerade support is probably not
-available (did you remember to <tt>modprobe ip_masq_pptp</tt> or
-<tt>modprobe ip_masq_ipsec</tt> if you compiled them as modules?). If you get
-complaints about <tt>/proc/ksyms</tt> not being available or <tt>/proc</tt> not
-being available, make sure that you have enabled the <tt>/proc</tt> filesystem
-in your kernel configuration.
+available - did you remember to <tt>modprobe ip_masq_pptp.o</tt> or
+<tt>modprobe ip_masq_ipsec.o</tt> if you compiled them as modules? If VPN
+masquerade stops working after you reboot, did you remember to add the
+<tt>modprobe</tt> commands into your <tt>/etc/rc.d/rc.local</tt> startup
+script?
+
+<p>
+If you get complaints about <tt>/proc/ksyms</tt> not being available or
+<tt>/proc</tt> not being available, make sure that you have enabled the
+<tt>/proc</tt> filesystem in your kernel configuration.
 <p>
 
 See the <htmlurl url="http://metalab.unc.edu/LDP/HOWTO/Kernel-HOWTO.html"
@@ -1003,7 +1120,7 @@ to the new IP address rather than using the old IP address. This does not
 mean that the session will continue across the interruption, rather that it
 will be closed down quickly.
 <p>
-If you do not do this, then there may be a "dead period" after you redial
+If you do not do this, then there may be a &quot;dead period&quot; after you redial
 and before old masq table entries expire where you're being masqueraded
 with the wrong IP address, which will prevent your establishing a
 connection.
@@ -1041,7 +1158,7 @@ traffic to the VPN server.
 <p>
 
 <itemize>
-<item>Configuring <tt>ipportfw</tt>
+<item>Configuring <tt>ipportfw</tt> under 2.0.x kernels
 <p>
 The following commands will set up <tt>ipportfw</tt> to forward the initial
 inbound 500/udp traffic to the IPsec server:
@@ -1099,7 +1216,7 @@ See <url url="http://www.wolfenet.com/~jhardin/ipfwadm/invocation.html">
 for more information on firewalling with a dynamic IP.
 <p>
 
-<item>Configuring <tt>ipfwd</tt>
+<item>Configuring <tt>ipfwd</tt> under both 2.0.x and 2.2.x kernels
 <p>
 The following command will set up <tt>ipfwd</tt> to forward the initial
 inbound 50/ip traffic to the IPsec server:
@@ -1125,12 +1242,11 @@ purely TCP- or UDP-based will not require <tt>ipfwd</tt>.
 <p>
 
 If you are masquerading a PPTP server you also need to make sure that you have
-not enabled PPTP Call ID masquerade in the kernel. Enabling PPTP Call ID
+<em>not</em> enabled PPTP Call ID masquerade in the kernel. Enabling PPTP Call ID
 masquerade builds in some assumptions that you're masquerading only PPTP
 clients, so enabling it will prevent proper masquerade of the PPTP server
-traffic. This also means that with this version of the patch you cannot
-simultaneously masquerade a PPTP server and PPTP clients. Contact me if this
-limitation causes you problems.
+traffic. This also means that with the 2.0.x version of the patch you cannot
+simultaneously masquerade a PPTP server and PPTP clients.
 <p>
 
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
@@ -1185,10 +1301,10 @@ ipfwadm -I -a deny -W eth1 -V 200.200.200.200
 </verb>
 </quote>
 <p>
-If you are installing firewall rules on forwarding and/or output, you will
-have do do something similar. The above example only covers VPN traffic;
-you will have to merge it into your existing firewall setup to allow any
-other traffic you need.
+If you are installing firewall rules on forwarding and/or rules on the inner
+interface, you will have do do something similar. The above example only covers
+VPN traffic; you will have to merge it into your existing firewall setup to
+allow any other traffic you need.
 <p>
 
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
@@ -1226,13 +1342,114 @@ ipfwadm -I -a deny -W eth1 -V 200.200.200.200
 </verb>
 </quote>
 
+<!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
+<sect1> ipchains setup for a Registered-IP VPN Server
+<p>
+Setting up a registered-IP VPN server behind a Linux firewall is a simple
+matter of making sure the appropriate routing and packet-filter commands
+are in place. Masquerading is not required.
+<p>
+The firewall rules will look something like this:
+<quote>
+<verb>
+# Specify the acceptable clients explicitly for tighter security.
+# Allow the IPsec ISAKMP traffic in and out.
+ipchains -A input  -j ACCEPT -p udp -s 199.0.0.2/32 500 -d 222.0.0.2/32 500 -i eth1
+ipchains -A output -j ACCEPT -p udp -d 199.0.0.2/32 500 -s 222.0.0.2/32 500 -i eth1
+ipchains -A input  -j ACCEPT -p udp -s 199.0.0.3/32 500 -d 222.0.0.2/32 500 -i eth1
+ipchains -A output -j ACCEPT -p udp -d 199.0.0.3/32 500 -s 222.0.0.2/32 500 -i eth1
+# Allow the IPsec ESP traffic in and out.
+ipchains -A input  -j ACCEPT -p 50  -s 199.0.0.2/32     -d 222.0.0.2/32     -i eth1
+ipchains -A output -j ACCEPT -p 50  -d 199.0.0.2/32     -s 222.0.0.2/32     -i eth1
+ipchains -A input  -j ACCEPT -p 50  -s 199.0.0.3/32     -d 222.0.0.2/32     -i eth1
+ipchains -A output -j ACCEPT -p 50  -d 199.0.0.3/32     -s 222.0.0.2/32     -i eth1
+# Allow the PPTP control channel in and out.
+ipchains -A input  -j ACCEPT -p tcp -s 199.0.0.2/32 -d 222.0.0.2/32 1723 -i eth1
+ipchains -A output -j ACCEPT -p tcp -d 199.0.0.2/32 -s 222.0.0.2/32 1723 -i eth1
+ipchains -A input  -j ACCEPT -p tcp -s 199.0.0.3/32 -d 222.0.0.2/32 1723 -i eth1
+ipchains -A output -j ACCEPT -p tcp -d 199.0.0.3/32 -s 222.0.0.2/32 1723 -i eth1
+# Allow the PPTP tunnel in and out.
+ipchains -A input  -j ACCEPT -p 47  -s 199.0.0.2/32 -d 222.0.0.2/32      -i eth1
+ipchains -A output -j ACCEPT -p 47  -d 199.0.0.2/32 -s 222.0.0.2/32      -i eth1
+ipchains -A input  -j ACCEPT -p 47  -s 199.0.0.3/32 -d 222.0.0.2/32      -i eth1
+ipchains -A output -j ACCEPT -p 47  -d 199.0.0.3/32 -s 222.0.0.2/32      -i eth1
+</verb>
+</quote>
+<p>
+If you are installing firewall rules on forwarding and/or rules on the inner
+interface, you will have do do something similar. The above example only covers
+VPN traffic; you will have to merge it into your existing firewall setup to
+allow any other traffic you need.
+<p>
+
+<!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
+<sect1> ipchains setup for a Registered-IP VPN Client
+<p>
+Setting up a registered-IP VPN client behind a Linux firewall is similar
+to setting up a registered-IP VPN server.
+<p>
+The firewall rules will look something like this:
+<quote>
+<verb>
+# Allow the IPsec ISAKMP traffic out and in.
+ipchains -A output -j ACCEPT -p udp -s 222.0.0.2/32 500 -d 199.0.0.1/32 500 -i eth1
+ipchains -A input  -j ACCEPT -p udp -d 222.0.0.2/32 500 -s 199.0.0.1/32 500 -i eth1
+# Allow the IPsec ESP traffic out and in.
+ipchains -A output -j ACCEPT -p 50  -s 222.0.0.2/32     -d 199.0.0.1/32     -i eth1
+ipchains -A input  -j ACCEPT -p 50  -d 222.0.0.2/32     -s 199.0.0.1/32     -i eth1
+# Allow the PPTP control channel out and in.
+ipchains -A output -j ACCEPT -p tcp -s 222.0.0.2/32 -d 199.0.0.1/32 1723 -i eth1
+ipchains -A input  -j ACCEPT -p tcp -d 222.0.0.2/32 -s 199.0.0.1/32 1723 -i eth1
+# Allow the PPTP tunnel out and in.
+ipchains -A output -j ACCEPT -p 47  -s 222.0.0.2/32 -d 199.0.0.1/32      -i eth1
+ipchains -A input  -j ACCEPT -p 47  -d 222.0.0.2/32 -s 199.0.0.1/32      -i eth1
+</verb>
+</quote>
+
+<!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
+<sect1> VPN Masq and LRP
+<p>
+The Linux Router Project at <url url="http://www.linuxrouter.org/">
+provides a Linux-based firewall-on-a-floppy kit. With a '386 PC, two
+network cards, and a diskette drive, you can set up a full-featured
+masquerading firewall. No hard disk is needed.
+
+<p>
+VPN Masquerade is supposed to be included in LRP version 2.2.9 - to verify
+it is available, see if <tt>ip_masq_ipsec</tt> or <tt>ip_masq_pptp</tt> are
+listed in the loadable modules in <tt>Package Settings -&gt; Modules</tt>,
+or grep <tt>/proc/ksyms</tt> as described above. If you want to add VPN
+masquerade to an earlier version of LRP then somebody on the LRP mailing
+list may be able to provide a diskette image for you, or you can roll your
+own kernel using the instructions available on the LRP home page.
+
+<p>
+The firewall rules would be added to the startup script file in
+<tt>Network Settings -&gt; Direct Network Setup</tt>.
+
+
+<!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
+<sect1> VPN Masq on a system running FreeS/WAN or PoPToP
+<p>
+If you are going to be using the firewall as an IPsec gateway with
+FreeS/WAN, you <em>must not</em> enable IPsec masquerade.
+If you are going to be using the firewall as a PPTP server with
+PoPToP, or a PPTP client using the Linux PPTP client software, you <em>must
+not</em> enable PPTP masquerade.
+<p>
+VPN masquerade and a VPN client or server using the same protocols cannot
+at this time coexist on the same computer.
+<p>
+Your firewall <em>can</em>, however, be a FreeS/WAN IPsec VPN gateway while
+masquerading PPTP traffic, or vice-versa.
+
 <!-- Section 4 -->
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
 <sect> Configuring the VPN client
 <p>
 
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
-<sect1> Configuring a MS W'95 or W'98 client
+<sect1> Configuring a MS W'95 client
 <p>
 <enum>
 <item>Set up your routing so that the Linux firewall is your default
@@ -1278,7 +1495,7 @@ Neighborhood&quot; and click on <tt>Properties</tt>.
 <item>Reboot when prompted to.
 
 <item>If you need to use strong (128-bit) encryption, download the
-strong encryption DUN update from the MS secure site at
+strong encryption DUN 1.3 update from the MS secure site at
 <url url="http://mssecure.www.conxion.com/cgi-bin/ntitar.pl"> and
 install it, then reboot again when prompted to.
 
@@ -1305,6 +1522,48 @@ network&quot; checkbox.
 </enum>
 <p>
 
+<!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
+<sect1> Configuring a MS W'98 client
+<p>
+<enum>
+<item>Set up your routing so that the Linux firewall is your default
+gateway and test masquerading as described above. 
+
+<item>Install and configure the VPN software. For IPsec software follow the
+manufacturer's instructions. For MS PPTP:
+
+<enum>
+<item>Open <tt>Control Panel/Add or Remove Software</tt> and click on the
+<tt>Windows Setup</tt> tab.
+
+<item>Click on the <tt>Communications</tt> option and click the
+&quot;Details&quot; button.
+
+<item>Make sure the &quot;Virtual Private Networking&quot;
+option is checked. Then click the &quot;OK&quot; button.
+
+<item>Reboot when prompted to.
+
+<item>If you need to use strong (128-bit) encryption, download the
+strong encryption VPN Security update from the MS secure site at
+<url url="http://mssecure.www.conxion.com/cgi-bin/ntitar.pl"> and
+install it, then reboot again when prompted to.
+
+</enum>
+
+<item>Create and test a new dial-up phonebook entry for your VPN server as
+described above.
+
+</enum>
+<p>
+
+<!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
+<sect1> Configuring a MS W'ME client
+<p>
+I haven't seen one of these yet. I expect the procedure is very similar to
+that for W'98. Could someone who has done this let me know what, if any,
+differences there are? Thanks.
+
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
 <sect1> Configuring a MS NT client
 <p>
@@ -1383,11 +1642,75 @@ performance enhancements.
 <p>
 
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
-<!--
 <sect1> Configuring for network-to-network routing
 <p>
 <em>Yet to be written.</em>
--->
+<p>
+You really ought to look at FreeS/WAN (IPsec for Linux) at
+<url url="http://www.xs4all.nl/~freeswan/"> instead of masquerading.
+
+<!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
+<sect1> Masquerading Checkpoint SecuRemote-based VPNs
+<p>
+It is possible to masquerade Checkpoint SecuRemote-based VPN traffic under
+certain circumstances.
+<p>
+First, you must configure the SecuRemote firewall to allow masqueraded
+sessions. On the SecuRemote firewall do the following:
+
+<enum>
+
+<item>Run <tt>fwstop</tt>
+
+<item>Edit <tt>$FWDIR/conf/objects.C</tt> and after the
+&quot;<tt>:props&nbsp;(</tt>&quot; line, add or modify the following lines
+to read: 
+<quote><verb>
+:userc_NAT (true) 
+:userc_IKE_NAT (true)
+</verb></quote>
+
+<item>Run <tt>fwstart</tt>
+
+<item>Re-install your security policy.
+
+<item>Verify the change took effect by checking both
+<tt>$FWDIR/conf/objects.C</tt> and
+<tt>$FWDIR/database/objects.C</tt>
+
+</enum>
+
+<p>
+If you use the IPsec protocols (called &quot;IKE&quot; by CheckPoint) you
+don't have to do anything else special to masquerade the VPN traffic.
+Simply configure your masquerading gateway to masquerade IPsec traffic as
+described above.
+<p>
+Checkpoint's proprietary FWZ protocol is more complicated. There are two
+modes that FWZ can be used in: encapsulated mode and transport mode. In
+encapsulated mode, integrity checking is done over the whole IP packet,
+just as in IPsec's AH protocol. Changing the IP address breaks this
+integrity guarantee, thus encapsulated FWZ tunnels <em>cannot</em> be
+masqueraded.
+<p>
+In transport mode, only the data portion of the packet is encrypted, and
+the IP headers are not verified against changes. In this mode, masquerading
+should work with the modifications described above.
+<p>
+The configuration for encapsulated or transport mode is done in the
+FireWall-1 GUI. In the network object for the Firewall, under the VPN
+tab, edit the FWZ properties. The third tab in FWZ properties allows you
+to set encapsulated mode.
+<p>
+You will only be able to masquerade one client at a time.
+<p>
+Further information can be found at:
+<itemize>
+<item> <url url="http://www.phoneboy.com/fw1/nat.html">,
+<item> <url url="http://www.phoneboy.com/fw1/faq/0141.html">
+<item> <url url="http://www.phoneboy.com/fw1/faq/0372.html">
+</itemize>
+<p>
 
 <!-- Section 5 -->
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
@@ -1433,7 +1756,7 @@ We will assume you're using a Windows-based client for the examples, as that's
 the most common case.
 
 <enum>
-<item>Connect information: the "telephone number" in the VPN dialup
+<item>Connect information: the &quot;telephone number&quot; in the VPN dialup
 configuration must be the Internet IP address of the VPN server, or the IP
 address of the firewall if the server is being masqueraded.
 
@@ -1442,7 +1765,7 @@ address of the firewall if the server is being masqueraded.
 to establish a strongly-encrypted session. Unfortunately in my experience
 this problem does not generate any obvious error messages, it just keeps
 trying and trying and trying... The strong encryption update can be
-obtained from the Microsoft secure site URL given int he &quot;Configuring
+obtained from the Microsoft secure site URL given in the &quot;Configuring
 a MS Client&quot; section.
 <p>
 This may also affect IPsec clients, if they use the MS-supplied encryption
@@ -1660,7 +1983,9 @@ on the remote network then you may experience this, PPTP or no PPTP.
 <p>
 If you're having trouble with IPX traffic over your PPTP link, please see
 sections 3.5 and 5.2 in this MS Knowledge Base article:
-<url url="http://support.microsoft.com/support/kb/articles/q154/0/91.asp">
+<url url="http://microsoft.com/ntserver/nts/downloads/recommended/dun13win95/ReleaseNotes.asp">
+<p>
+The same considerations probably apply to Win'98 as well.
 <p>
 Thanks to David Griswold <htmlurl url="mailto:dgriswol@ix.netcom.com"
 name="&lt;dgriswol@ix.netcom.com&gt;">
@@ -1715,14 +2040,33 @@ the rekey couldn't be routed to the masqueraded host. The rekey traffic
 would be discarded, the remote IPsec host would think the link had failed,
 and the connection would eventually be terminated.
 <p>
-The 2.0.36 patch has been modified to increase the timeout on ISAKMP UDP masq
-table entries. Get the current version of the patch, available via the sites
-given in the Resources section, and repatch and recompile your kernel.
+The 2.0.x patch has been modified from its original version to increase the
+timeout on ISAKMP UDP masq table entries. Get the current version of the patch,
+available via the sites given in the Resources section, and repatch and
+recompile your kernel.
 <p>
 Also verify that your <tt>IPsec Masq Table Lifetime</tt> parameter is
 configured to be the same as or slightly longer than your rekey interval.
 <p>
 
+<!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
+<sect1> If VPN masquerade fails to work after you reboot
+<p>
+Did you remember to put <tt>modprobe ip_masq_pptp.o</tt> or
+<tt>modprobe ip_masq_ipsec.o</tt> commands into your
+<tt>/etc/rc.d/rc.local</tt> startup script if you compiled VPN Masq support
+as modules?
+<p>
+
+<!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
+<sect1> If your second PPTP session kills your first session
+<p>
+<htmlurl url="http://andrew2.andrew.cmu.edu/rfc/rfc2637.html"
+name="The PPTP RFC"> specifies that there may only be one control channel
+between two systems. This may mean that only one masqueraded client will be
+able to contact a given PPTP server at a time. See <ref id="multiclientpptp">
+for more details.
+
 <!-- Section 6 -->
 <!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
 <sect> IPsec masquerade technical notes and special security considerations
@@ -1795,7 +2139,7 @@ collision happening for each host, at the time of establishing the initial
 ISAKMP connection.
 <p>
 Correcting this requires including the responder cookie in the key used to
-route inbound ISAKMP traffic. This modification will be incorporated into
+route inbound ISAKMP traffic. This modification is incorporated into
 IPsec masquerade for the 2.2.x kernel, and the short window between the
 time the masqueraded host initiates the ISAKMP exchange and the remote host
 responds is covered by discarding any new ISAKMP traffic that would collide
@@ -1830,10 +2174,19 @@ This is discussed in detail in the next section.
 
 </itemize>
 
-The 2.2.x code by default prevents the establishment of multiple
-connections to the same remote host. If the weaknesses exposed by multiple
-connections to the same remote host are acceptable, you can enable
-"parallel sessions".
+To avoid these problems the 2.2.x code by default prevents the
+establishment of multiple connections to the same remote host. If the
+weaknesses exposed by multiple connections to the same remote host are
+acceptable, you can enable &quot;parallel sessions&quot;.
+<p>
+Blocking parallel sessions for security reasons can be annoying: there is
+no way for the IPsec masquerade code to sniff the session and see when it
+is terminating, so the masquerade table entries will persist for the IPsec
+Masq Table Lifetime even if the session terminates immediately after it is
+established. If parallel sessions are prevented, this means that the
+server will be unavailable to other clients until the masq table entry for
+the most recent session has timed out and been deleted. This can be up to
+several hours.
 
 <p>
 <sect1> Proper routing of inbound encrypted traffic
@@ -1901,18 +2254,19 @@ outbound SPI, which would cause inbound traffic to be routed to the wrong
 masqueraded host. If this happens the masqueraded host receiving the
 traffic in error will discard it because it has an unexpected SPI value,
 and everybody will eventually time out, rekey and try again. This can be
-addressed by editing <tt>/usr/src/linux/net/ipv4/ip_masq.c</tt> and
-increasing the INIT lifetime or the number of INIT retries permitted,
-at the cost of increasing the blocking (and DoS) window.
+addressed by editing <tt>/usr/src/linux/net/ipv4/ip_masq.c</tt>
+(<tt>ip_masq_ipsec.c</tt> in 2.2.x) and increasing the INIT lifetime or the
+number of INIT retries permitted, at the cost of increasing the blocking
+(and DoS) window.
 <p>
 <item>Sessions idle or semi-idle (with infrequent inbound traffic and
 no outbound traffic) for a long period of time may be idle long enough for
 the masq table entry to expire. If the remote host sends traffic to an
-established yet expired session while an outstanding init to the same
+established yet masq-expired session while an outstanding init to the same
 remote host is underway, the traffic may be misrouted for the same reason
 as described above. This can be addressed by making sure the <tt>IPsec Masq
 Table Lifetime</tt> kernel configuration parameter is slightly longer than the
-rekey interval, which is the longest time any given SPI pair will be used.
+rekey interval, which is the longest time any given SPI pair should be used.
 The problem here is that you may not know all of the rekey intervals if
 you're masquerading for many remote servers, or some may have their rekey
 intervals set to unreasonably high values, such as several hours.