Re: 2.4 and ipmasq modules

[Rusty Russell]

In message <[e-mail]> you write:
> It was great to see that 2.4.0 reintroduced ipfwadm support! I had no
> need for ipchains and ended up using the wrapper around it that
> emulated ipfwadm. However, 2.[02].x used to have "special IP
> masquerading modules" such as ip_masq_ftp.o, ip_masq_quake.o, etc. I
> can't find these in 2.4.0. Where have they gone? Without important
> modules such as ip_masq_ftp.o I cannot use non-passive ftp from behind
> the masquerading firewall.

Hi Aaron,

The entire point of the netfilter kernel architecture is that we can
just ask for packets at certain points, no #ifdefs, special hacks,
etc.  Unfortunately, the previous masquerading code (used in 2.0 and
2.2) looked really difficult to extract from the kernel.  Netfilter
has changed a little since then (particularly NF_STOLEN), so it might
be possible now.

So I reimplimented 2.2-style masquerading on top of the new NAT
infrastructure: ideally this would mean that it could use the new
helpers, but there were some minor technical problems, and it was
never tested.  

Those who berated Aaron for not wanting to upgrade: he is the Debian
maintainer for crashme, gtk-theme-switch, koules, pngcrush, and
xdaliclock.  By wasting his time making him convert a perfectly
working system, you are taking away time from those projects.  I'd
rather see him spend time on Cool Stuff(TM) which benefits all of us.

Cheers,
Rusty.
--
Premature optmztion is rt of all evl. --DK