## SafeFire PPP

### v1.0

# Thesaurus

This book lists most of network terms used in SafeFire PPP, describes them and provides details on usage.

- ### Callback

  > This feature enables special mode of dialing operations.

  > Client dials to server, communicates to it (including authorization) and then closes connection.

  > After that server calls back to client (while client is waiting for a call) and connection is established.

  > This can be done for following reasons (the list is not full of course):

  > 1. Being properly configured, call back may provide reasonable level of security by limiting number of phone numbers from which establishing of working connections are allowed. Caller-ID feature sometimes used for such a purpose can't provide such level of security.
  > 2. Save phone call charges by client. In many countries caller pays. Also it is possible to have situation when back call is cheaper than direct call. This is especially the case for international calls.
  > 3. Free phone line. The back call can be issued from "no-number" phone line leaving phone line with number assigned free for other incoming calls.
  > 4. Use better line. It is possible that back call produces better connection quality.

  > SafeFire PPP supports this features. In the most easy way (when server knows phone number to dial), you simply set "callback.mode=CLIENT" in PPPPort plugin ([ppp] section in sample configuration files). If server don't know number to call or have list of numbers, you need to specify number in the "callback.client.phone" variable of the same plugin.

  > For details see PPPPort information in the Plugin Reference.

- ### Compression Control Protocol (CCP)

  > This protocol is used to compress data flow between two sides in Point to Point Protocol (PPP).

  > This protocol may use different method of compression. That's why to compress data, sides must not only support this protocol but also have at least one common compression method.

  > SafeFire PPP implements following compression methods:

  > - Deflate
  > - Pred

- ### Dial on demand (DOD)

  > This feature gives new possibility to user: automatic establishment of internet connection. Using it with idle timer

  (that allows automatic disconnect) gives very good results. It can be used at standalone computers, but it is especially useful when LAN is connected to the Internet using Dial-Up connection.

  In short, this feature "hides" Connect button. Connection is requested at startup, but read dialing and connecting is performed only when it is needed.

  With this option enabled, PPP client on startup (or after connection being broken) starts listen to network (without dialing). When packet with destination to external net come, it is used as "time to dial" flag and dialing is started. So to start connecting user simply open any program (like Web Explore or Mail client) and request some external data (mail check/open web page).

  To configure DOD in SafeFire PPP, "dod.*" variables in the PPPPort plugin is used.

  In sample configuration files, you need simply to set dod.enabled variable in the [ppp] section to "yes".

  If you has Dialing activated when no request were made, it is highly possible that you have some packets that are sent automatically by different services. Good examples are Netbios over TCP/IP or DNS packets.

  To find out what packets cause Dialing, enable dodfilter packet filter and add one rule: "allow log all from any to any". You will have all packets that trigger DOD logged in log facility.

  To learn how to enable logging, please see Logging book.

- ### Firewall

  > Usually firewall is used to protects internal network or single computer from external access (or attacks) and to limit connections that can be established by protected computer to external hosts by dropping certain packets flowing through them.

  > Since firewall must intercept packets before they will reach protected computers (or it's protocol stack in case of single computer protection), two schemes of setting up firewall are the most popular ones:

  > 1. Setting up firewall at the device that provides access to the external net ("router"). In this case all packets will go through this device and can be easily intercepted by firewall.
  > 2. Setting up firewall at the protected computer between device driver of network access device (like network card or modem) and protocol stack. In this case firewall will intercept all the packets going to (or from) the computer. Since all high-level processing (starting from IP level) is done by protocol stack, this is safe way to protect your computer in case of Dial-Up access.

  > SafeFire PPP implements packet filter and Network Address Translation types of firewall protection.

- ### IP addresses

  > IP addresses are identifiers that are used in IP networks to address hosts.

  > For IPv4 (most widely used version of IP protocol for now) IP address is group of four bytes. Usually it is displayed as for decimal numbers separated with "." (dot) sign.

  > Example: 1.2.3.4

  > IP addresses are grouped into subnets by using netmasks. First address of the subnet is "whole subnet" address, last is "all hosts broadcast" address. They can't be used as addresses for regular hosts.

  > In the network each host must have unique address. Proxies are used to connect networks that may have hosts with equal addresses or incompatible address ranges.

  > TCP/IP specifications specify two address ranges:

  > 1. Private space defined by RFC1918 as follows:

  >    Start of range | End of range
  >    --- | ---
  >    10.0.0.0 | 10.255.255.255
  >    172.16.0.0 | 172.31.255.255
  >    192.168.0.0 | 192.168.255.255

  > 2. Internet address space - all the others. Addresses must be received from organizations that either provide high-level IP addresses delegations or that has free IP addresses (usually as part of other service, like internet connection).

  > Note: Private address range addresses can't be used in the Internet.

- ### Masquerading

  > See Network Address Translation (NAT)

- ### Netmask

  > Netmasks are used to group IP addresses into subnets.

  > Netmask are special ip addresses with first n bits set to 1, others to 0.

  > "Set" bits define subnet address part of IP address, while "Reset" bits define host address in the subnet.

  > Two addresses are defined to be in the subnet with defined submask if it's subnet address parts are equal.

  > Address with host address part set to 0 is "subnet IP address", while if all bits in host address part of address are set this is special "broadcast address". This two addresses must not be used as host addresses.

  > Examples:

  > - 255.255.255.255

  >   > Since this submask has no host address field, this is "single address" mask.

  > - 0.0.0.0

  >   > Since this submask has no subnet address field, this is "all addresses" mask - the only net that may have this netmask is 0.0.0.0 net and this means Internet.

  > - 255.255.255.0

  >   > This is class C netmask that is very widely used in small network. It groups up to 253 addresses.

  >   > Example: Subnet 192.168.1.0 has netmask 255.255.255.0, broadcast address 192.168.1.255 and addresses from 192.168.1.1 to 192.168.1.254 belong to this subnet.

- ### Network Address Translation (NAT)

  > Usually when connecting to the Internet, user receives one real IP address (either dynamically or statically assigned) for the computer (or specialized device) that will perform connection.

  > But often there is a need to connect the whole LAN.

  > Of course, it is possible to get pack of real IP addresses and assign each computer it's own real IP, but this will mean that since the computers will appear as fully functional Internet hosts, all this computers must be well protected from external attacks.

  > That's why different kinds of proxies are used to provide access to Internet to this computer.

  > NAT is a kind of low-level IP proxy.

  > The main advantages of NAT is that it requires no special client software installed at client computers (like in SOCKS case) and that is can proxy any outgoing (and in some cases incoming) IP connections (unlike to WWW proxy, when only HTTP protocol is proxied).

  > The simplest mode of NAT is dynamic NAT mode - where all TCP connections from internal stations are automatically masked as connections from computer that has NAT software installed (it is computer that has real IP). This computer will be named host below.

  > But some higher level protocols may require incoming connections to be established (good example is Active FTP mode). And address of the host to be connected is specified in the TCP data flow (i.e. FTP PORT command).

  > In this case case NAT software must have special processing of such a connections. It must:

  > 1. Alter TCP data flow to change internal socket address to host's socket.
  > 2. Allow incoming connection to host's socket specified above and map it to internal socket address taken from TCP data before change.

  > Also some higher level protocol can use UDP (connectionless protocol) to create it's virtual connections. In this case special processing is needed too.

  > SafeFire PPP has such processing for a number of higher level protocols.

  > Other kind of NAT is Port Mapping. This feature is used to process incoming connections and map them to some internal computer (for example when internal computer has Web server, port mapping can be used to map 80 port of host to 80 port of this computer).

  > An example of dynamic creation of port mapping rules was provided above.

  > But in SafeFire PPP it is also possible to create static port mapping rules either to provide access to some internal server or to provide limited access to unsupported "special" higher level protocols described above.

  > For details about setting up SafeFire PPP NAT module see Plugin Reference.

- ### Packet filter

  > Packet filter is a kind of firewall. It has a set of rules that defines packet attributes checks and action (like pass or drop packet) that must be done if packet conforms to the rule.

  > This is the simplest kind of firewall. Since each packet is processed independently and no "history" is stored, this firewall (in most cases) can't be used to filter connections.

  > SafeFire PPP implements IP packet filter. Details on it's usage can be found in Packet Filter Guide and Reference

- ### Point to Point Protocol(PPP)

  > This protocol allows to connect two hosts and process configuration and data flow of different network and utility protocols.

  > SafeFire PPP can be used to establish IP connection using PPP protocol.

  > SafeFire PPP can establish PPP connections in two environments:

  > 1. Serial connection (Modem/null-modem/ISDN (with 3rd party software) connection)
  > 2. Ethernet segment (PPPoE)

- ### Port mapping

  > See Network Address Translation (NAT)

- ### PPP over Ethernet(PPPoE)

  > PPPoE is implementation of PPP protocol that uses Ethernet segment as underlying environment.

  > Now PPPoE is widely used by xDSL providers.

  > This protocol gives next pluses (comparing to standard IP over Ethernet + DHCP way):

  > 1. Defined "connected" state - provider can easily check what client are online and gather statistics.
  > 2. Standard security - PPP protocol provides standard means to authenticate, authorize and even crypt data stream if required.
  > 3. Standard stream compression - one can get faster internet access by using Conpression Control Protocol

  > SafeFire PPP can work as both PPPoE client and PPPoE server. At present time server implementation is limited to one client connection. This can be used to establish Point-to-Point PPPoE connections.

  > For details on setting up PPPoE in SafeFire PPP see PPP over Ethernet Configuration Guide

- ### Proxy

  > Proxies are used to hide computers from one network and present in second network connections from/to it as connections from/to computer that is connected to both networks.

  > They

  > 1. Intercept connections from internal computers to external net (they can either require special client software (SOCKS), special support in user programs (WWW/FTP proxies) or perform transparent(NAT)).
  > 2. Make connections from host computer (computer that has proxy software installed) to needed external hosts to fulfill intercepted connections requests.

  > Some kind of proxy (NAT) can also intercept external connections to the host by providing access to selected resources of internal computers.

  > SafeFire PPP implements NAT proxy.

Return to documentation index | SafeFire PPP (C) Link Guard Solutions 1999, 2000