4.7. Interface layer commands

This chapter describes commands that configure the interface layer. All of these commands apply to the currently active bundle.

Note that while most of the time mpd is used for transmitting IP traffic, it is designed to support other (currently unimplemented) protocols such as AppleTalk, IPX, etc. This is why the Interface layer (which is protocol independent) is distinct from the IP Control Protocol (IPCP) layer which is specific to IP.

set iface addrs local-ip remote-ip

This command is only required when dial-on-demand is enabled. Normally, mpd configures the interface with the IP addresses that were negotiated when connecting the link. Since dial-on-demand configures the interface before actually connecting, mpd has to be told initial local and remote IP addresses to give the interface. These addresses don't have to correspond to the ``real'' ones; in fact, both addresses can be completely fictional. If and when different addresses are negotiated later, mpd will automatically renumber the interface and adjust the routes.

set iface route address[/width]

This command associates a route with the bundle. Whenever the interface is configured up, all associated routes are added. A route of default indicates the default route. Otherwise, the route is a network address with optional netmask width (e.g., 192.168.1.0/24). If the netmask width is omitted, a single host route is assumed (i.e., a width of 32).

Routes are automatically removed when the interface is brought down.

set iface mtu value

This command sets an upper bound on the MTU that will be configured on the interface when the bundle comes up. This value is not used at all during link negotiation; there are separate bundle and link commands for configuring that. Even if a higher bundle MTU is negotiated, this limit will still apply.

This command is useful when you want to manually restrict the MTU of the interface for other reasons, e.g., if you're also doing IPSec. The default value is 1500.

set iface idle seconds

Sets the idle timeout value for the bundle. If no incoming or outgoing packets are transmitted for seconds seconds, the connection is brought down. An idle timeout of zero disables this feature.

When the idle timeout occurs, if the dial-on-demand option is enabled, mpd goes back into dial-on-demand mode. Otherwise, the interface is brought down and all associated routes removed.

set iface session seconds

Sets the session timeout value for the bundle.

set iface up-script script

set iface down-script script

Mpd can optionally run a user program every time one of network protocols at the interface is brought up or down. The up-script is called like this:

script interface proto local-ip remote-ip authname [ dns1 server-ip ] [ dns2 server-ip ]

The down-script is called like this:

script interface proto local-ip remote-ip authname

set iface enable option ...
set iface disable option ...

Enable and disable the various interface layer options for the bundle.

The options available at the interface layer are:

on-demand

This option causes the interface to operate in dial-on-demand mode, allowing you to have a ``virtual full time'' connection. An OPEN event causes the interface to be configured, but the actual connection of the link is delayed until qualifying outgoing traffic is detected. Moreover, after an idle timeout, the interface is not brought down; further traffic will bring the link back up again.

proxy-arp

When this option is enabled, if after link negotiation the peer's IP address is determined to lie on a local subnet, then mpd will arrange for the local machine to install a proxy ARP entry for the remote machine's IP address.

For example, suppose the local machine lies on a LAN with address 192.168.1.10, and another machine will be connecting via mpd and using the LAN address 192.168.1.20. Then these commands would set up proxy ARP for the remote machine:

set iface enable proxy-arp
set ipcp ranges 192.168.1.10/32 192.168.1.20/32

tcpmssfix

This option causes mpd to adjust incoming and outgoing TCP SYN segments so that the requested maximum segment size is not greater than the amount allowed by the interface MTU.

This is necessary in many setups to avoid problems caused by routers that drop ICMP Datagram Too Big messages. Without these messages, the originating machine sends data, it passes the rogue router then hits a machine that has an MTU that is not big enough for the data. Because the IP Don't Fragment option is set, this machine sends an ICMP Datagram Too Big message back to the originator and drops the packet. The rogue router drops the ICMP message and the originator never gets to discover that it must reduce the fragment size or drop the IP Don't Fragment option from its outgoing data.

The code is based on tcpmssd wich was written by Ruslan Ermilov <ru@FreeBSD.org> based on work done by Patrick Bihan-Faou <patrick@mindstep.com>.

This option is disabled by default.

tee

If enabled, a ng_tee(4) node will be inserted into the bundle graph, right after the interface node. The tee node can be useful for debugging or traffic accounting.

nat

If enabled, a ng_nat(4) node will be inserted into the bundle graph. The ng_nat(4) node performs network address translation (NAT) of packets passing through it. ng_nat(4) node type exists since FreeBSD 6.0.

netflow-in

netflow-out

If enabled, the bundle will participate in NetFlow generation. See the NetFlow chapter for more information. The netflow-out option is like netflow-in, but generates NetFlow data for outgoing packets instead of incoming.

ipacct

If enabled, the bundle will participate in IP accounting with ng_ipacct node.