Chapter 30. Basic Networking

Contents

30.1. IP Addresses and Routing
30.2. IPv6—The Next Generation Internet
30.3. Name Resolution
30.4. Configuring a Network Connection with YaST
30.5. Configuring VLAN Interfaces on SUSE Linux
30.6. Managing Network Connections with NetworkManager
30.7. Configuring a Network Connection Manually
30.8. smpppd as Dial-up Assistant

Abstract

Linux offers the necessary networking tools and features for integration into all types of network structures. The customary Linux protocol, TCP/IP, has various services and special features, which are discussed here. Network access using a network card, modem, or other device can be configured with YaST. Manual configuration is also possible. Only the fundamental mechanisms and the relevant network configuration files are discussed in this chapter.

Linux and other Unix operating systems use the TCP/IP protocol. It is not a single network protocol, but a family of network protocols that offer various services. The protocols listed in Table 30.1, “Several Protocols in the TCP/IP Protocol Family” are provided for the purpose of exchanging data between two machines via TCP/IP. Networks combined by TCP/IP, comprising a worldwide network are also referred to, in their entirety, as the Internet.

RFC stands for Request for Comments. RFCs are documents that describe various Internet protocols and implementation procedures for the operating system and its applications. The RFC documents describe the setup of Internet protocols. To expand your knowledge about any of the protocols, refer to the appropriate RFC documents. They are available online at http://www.ietf.org/rfc.html.

Table 30.1. Several Protocols in the TCP/IP Protocol Family

Protocol

Description

TCP

Transmission Control Protocol: A connection-oriented secure protocol. The data to transmit is first sent by the application as a stream of data then converted by the operating system to the appropriate format. The data arrives at the respective application on the destination host in the original data stream format in which it was initially sent. TCP determines whether any data has been lost during the transmission and that there is no mix-up. TCP is implemented wherever the data sequence matters.

UDP

User Datagram Protocol: A connectionless, insecure protocol. The data to transmit is sent in the form of packets generated by the application. The order in which the data arrives at the recipient is not guaranteed and data loss is a possibility. UDP is suitable for record-oriented applications. It features a smaller latency period than TCP.

ICMP

Internet Control Message Protocol: Essentially, this is not a protocol for the end user, but a special control protocol that issues error reports and can control the behavior of machines participating in TCP/IP data transfer. In addition, it provides a special echo mode that can be viewed using the program ping.

IGMP

Internet Group Management Protocol: This protocol controls machine behavior when implementing IP multicast.


As shown in Figure 30.1, “Simplified Layer Model for TCP/IP”, data exchange takes place in different layers. The actual network layer is the insecure data transfer via IP (Internet protocol). On top of IP, TCP (transmission control protocol) guarantees, to a certain extent, security of the data transfer. The IP layer is supported by the underlying hardware-dependent protocol, such as ethernet.

Figure 30.1. Simplified Layer Model for TCP/IP

Simplified Layer Model for TCP/IP

The diagram provides one or two examples for each layer. The layers are ordered according to abstraction levels. The lowest layer is very close to the hardware. The uppermost layer, however, is almost a complete abstraction from the hardware. Every layer has its own special function. The special functions of each layer are mostly implicit in their description. The data link and physical layers represent the physical network used, such as ethernet.

Almost all hardware protocols work on a packet-oriented basis. The data to transmit is packaged in packets, because it cannot be sent all at once. The maximum size of a TCP/IP packet is approximately 64 KB. Packets are normally quite a bit smaller, because the network hardware can be a limiting factor. The maximum size of a data packet on an ethernet is about fifteen hundred bytes. The size of a TCP/IP packet is limited to this amount when the data is sent over an ethernet. If more data is transferred, more data packets need to be sent by the operating system.

For the layers to serve their designated functions, additional information regarding each layer must be saved in the data packet. This takes place in the header of the packet. Every layer attaches a small block of data, called the protocol header, to the front of each emerging packet. A sample TCP/IP data packet traveling over an ethernet cable is illustrated in Figure 30.2, “TCP/IP Ethernet Packet”. The proof sum is located at the end of the packet, not at the beginning. This simplifies things for the network hardware.

Figure 30.2. TCP/IP Ethernet Packet

TCP/IP Ethernet Packet

When an application sends data over the network, the data passes through each layer, all implemented in the Linux kernel except the physical layer. Each layer is responsible for preparing the data so it can be passed to the next layer. The lowest layer is ultimately responsible for sending the data. The entire procedure is reversed when data is received. Like the layers of an onion, in each layer the protocol headers are removed from the transported data. Finally, the transport layer is responsible for making the data available for use by the applications at the destination. In this manner, one layer only communicates with the layer directly above or below it. For applications, it is irrelevant whether data is transmitted via a 100 Mbit/s FDDI network or via a 56-Kbit/s modem line. Likewise, it is irrelevant for the data line which kind of data is transmitted, as long as packets are in the correct format.

30.1. IP Addresses and Routing

The discussion in this section is limited to IPv4 networks. For information about IPv6 protocol, the successor to IPv4, refer to Section 30.2, “IPv6—The Next Generation Internet”.

30.1.1. IP Addresses

Every computer on the Internet has a unique 32-bit address. These 32 bits (or 4 bytes) are normally written as illustrated in the second row in Example 30.1, “Writing IP Addresses”.

Example 30.1. Writing IP Addresses

IP Address (binary):  11000000 10101000 00000000 00010100
IP Address (decimal):      192.     168.       0.      20

In decimal form, the four bytes are written in the decimal number system, separated by periods. The IP address is assigned to a host or a network interface. It cannot be used anywhere else in the world. There are exceptions to this rule, but these are not relevant in the following passages.

The points in IP addresses indicate the hierarchical system. Until the 1990s, IP addresses were strictly categorized in classes. However, this system has proven too inflexible and was discontinued. Now, classless routing (CIDR, classless interdomain routing) is used.

30.1.2. Netmasks and Routing

Netmasks are used to define the address range of a subnetwork. If two hosts are in the same subnetwork, they can reach each other directly, if they are not in the same subnetwork, they need the address of a gateway that handles all the traffic between the subnetwork and the rest of the world. To check if two IP addresses are in the same subnet, simply AND both addresses with the netmask. If the result is identical, both IP addresses are in the same local network. If there are differences, the remote IP address, and thus the remote interface, can only be reached over a gateway.

To understand how the netmask works, look at Example 30.2, “Linking IP Addresses to the Netmask”. The netmask consists of 32 bits that identify how much of an IP address belongs to the network. All those bits that are 1 mark the corresponding bit in the IP address as belonging to the network. All bits that are 0 mark bits inside the subnetwork. This means that the more bits are 1, the smaller the subnetwork is. Because the netmask always consists of several successive 1 bits, it is also possible to just count the number of bits in the netmask. In Example 30.2, “Linking IP Addresses to the Netmask” the first net with 24 bits could also be written as 192.168.0.0/24.

Example 30.2. Linking IP Addresses to the Netmask

IP address (192.168.0.20):  11000000 10101000 00000000 00010100
Netmask   (255.255.255.0):  11111111 11111111 11111111 00000000
---------------------------------------------------------------
Result of the link:         11000000 10101000 00000000 00000000
In the decimal system:           192.     168.       0.       0

IP address (213.95.15.200): 11010101 10111111 00001111 11001000
Netmask    (255.255.255.0): 11111111 11111111 11111111 00000000
---------------------------------------------------------------
Result of the link:         11010101 10111111 00001111 00000000
In the decimal system:           213.      95.      15.       0

To give another example: all machines connected with the same ethernet cable are usually located in the same subnetwork and are directly accessible. Even when the subnet is physically divided by switches or bridges, these hosts can still be reached directly.

IP addresses outside the local subnet can only be reached if a gateway is configured for the target network. In the most common case, there is only one gateway that handles all traffic that is external. However, it is also possible to configure several gateways for different subnets.

If a gateway has been configured, all external IP packets are sent to the appropriate gateway. This gateway then attempts to forward the packets in the same manner—from host to host—until it reaches the destination host or the packet's TTL (time to live) expires.

Table 30.2. Specific Addresses

Address Type

Description

Base Network Address

This is the netmask AND any address in the network, as shown in Example 30.2, “Linking IP Addresses to the Netmask” under Result. This address cannot be assigned to any hosts.

Broadcast Address

This basically says, Access all hosts in this subnetwork. To generate this, the netmask is inverted in binary form and linked to the base network address with a logical OR. The above example therefore results in 192.168.0.255. This address cannot be assigned to any hosts.

Local Host

The address 127.0.0.1 is assigned to the loopback device on each host. A connection can be set up to your own machine with this address.


Because IP addresses must be unique all over the world, you cannot just select random addresses. There are three address domains to use if you want to set up a private IP-based network. These cannot get any connection from the rest of the Internet, because they cannot be transmitted over the Internet. These address domains are specified in RFC 1597 and listed in Table 30.3, “Private IP Address Domains”.

Table 30.3. Private IP Address Domains

Network/Netmask

Domain

10.0.0.0/255.0.0.0

10.x.x.x

172.16.0.0/255.240.0.0

172.16.x.x172.31.x.x

192.168.0.0/255.255.0.0

192.168.x.x


30.2. IPv6—The Next Generation Internet

[Important]IBM System z: IPv6 Support

IPv6 is not supported by the CTC and IUCV network connections of the IBM System z hardware.

Due to the emergence of the WWW (World Wide Web), the Internet has experienced explosive growth with an increasing number of computers communicating via TCP/IP in the past fifteen years. Since Tim Berners-Lee at CERN (http://public.web.cern.ch) invented the WWW in 1990, the number of Internet hosts has grown from a few thousand to about a hundred million.

As mentioned, an IPv4 address consists of only 32 bits. Also, quite a few IP addresses are lost—they cannot be used due to the way in which networks are organized. The number of addresses available in your subnet is two to the power of the number of bits, minus two. A subnetwork has, for example, 2, 6, or 14 addresses available. To connect 128 hosts to the Internet, for example, you need a subnetwork with 256 IP addresses, from which only 254 are usable, because two IP addresses are needed for the structure of the subnetwork itself: the broadcast and the base network address.

Under the current IPv4 protocol, DHCP or NAT (network address translation) are the typical mechanisms used to circumvent the potential address shortage. Combined with the convention to keep private and public address spaces separate, these methods can certainly mitigate the shortage. The problem with them lies in their configuration, which is a chore to set up and a burden to maintain. To set up a host in an IPv4 network, you need a number of address items, such as the host's own IP address, the subnetmask, the gateway address, and maybe a name server address. All these items need to be known and cannot be derived from somewhere else.

With IPv6, both the address shortage and the complicated configuration should be a thing of the past. The following sections tell more about the improvements and benefits brought by IPv6 and about the transition from the old protocol to the new one.

30.2.1. Advantages

The most important and most visible improvement brought by the new protocol is the enormous expansion of the available address space. An IPv6 address is made up of 128 bit values instead of the traditional 32 bits. This provides for as many as several quadrillion IP addresses.

However, IPv6 addresses are not only different from their predecessors with regard to their length. They also have a different internal structure that may contain more specific information about the systems and the networks to which they belong. More details about this are found in Section 30.2.2, “Address Types and Structure”.

The following is a list of some other advantages of the new protocol:

Autoconfiguration

IPv6 makes the network plug and play capable, which means that a newly set up system integrates into the (local) network without any manual configuration. The new host uses its automatic configuration mechanism to derive its own address from the information made available by the neighboring routers, relying on a protocol called the neighbor discovery (ND) protocol. This method does not require any intervention on the administrator's part and there is no need to maintain a central server for address allocation—an additional advantage over IPv4, where automatic address allocation requires a DHCP server.

Mobility

IPv6 makes it possible to assign several addresses to one network interface at the same time. This allows users to access several networks easily, something that could be compared with the international roaming services offered by mobile phone companies: when you take your mobile phone abroad, the phone automatically logs in to a foreign service as soon as it enters the corresponding area, so you can be reached under the same number everywhere and are able to place an outgoing call just like in your home area.

Secure Communication

With IPv4, network security is an add-on function. IPv6 includes IPsec as one of its core features, allowing systems to communicate over a secure tunnel to avoid eavesdropping by outsiders on the Internet.

Backward Compatibility

Realistically, it would be impossible to switch the entire Internet from IPv4 to IPv6 at one time. Therefore, it is crucial that both protocols are able to coexist not only on the Internet, but also on one system. This is ensured by compatible addresses (IPv4 addresses can easily be translated into IPv6 addresses) and through the use of a number of tunnels. See Section 30.2.3, “Coexistence of IPv4 and IPv6”. Also, systems can rely on a dual stack IP technique to support both protocols at the same time, meaning that they have two network stacks that are completely separate, such that there is no interference between the two protocol versions.

Custom Tailored Services through Multicasting

With IPv4, some services, such as SMB, need to broadcast their packets to all hosts in the local network. IPv6 allows a much more fine-grained approach by enabling servers to address hosts through multicasting—by addressing a number of hosts as parts of a group (which is different from addressing all hosts through broadcasting or each host individually through unicasting). Which hosts are addressed as a group may depend on the concrete application. There are some predefined groups to address all name servers (the all name servers multicast group), for example, or all routers (the all routers multicast group).

30.2.2. Address Types and Structure

As mentioned, the current IP protocol is lacking in two important aspects: there is an increasing shortage of IP addresses and configuring the network and maintaining the routing tables is becoming a more complex and burdensome task. IPv6 solves the first problem by expanding the address space to 128 bits. The second one is countered by introducing a hierarchical address structure, combined with sophisticated techniques to allocate network addresses, as well as multihoming (the ability to assign several addresses to one device, giving access to several networks).

When dealing with IPv6, it is useful to know about three different types of addresses:

Unicast

Addresses of this type are associated with exactly one network interface. Packets with such an address are delivered to only one destination. Accordingly, unicast addresses are used to transfer packets to individual hosts on the local network or the Internet.

Multicast

Addresses of this type relate to a group of network interfaces. Packets with such an address are delivered to all destinations that belong to the group. Multicast addresses are mainly used by certain network services to communicate with certain groups of hosts in a well-directed manner.

Anycast

Addresses of this type are related to a group of interfaces. Packets with such an address are delivered to the member of the group that is closest to the sender, according to the principles of the underlying routing protocol. Anycast addresses are used to make it easier for hosts to find out about servers offering certain services in the given network area. All servers of the same type have the same anycast address. Whenever a host requests a service, it receives a reply from the server with the closest location, as determined by the routing protocol. If this server should fail for some reason, the protocol automatically selects the second closest server, then the third one, and so forth.

An IPv6 address is made up of eight four-digit fields, each representing 16 bits, written in hexadecimal notation. They are also separated by colons (:). Any leading zero bytes within a given field may be dropped, but zeros within the field or at its end may not. Another convention is that more than four consecutive zero bytes may be collapsed into a double colon. However, only one such :: is allowed per address. This kind of shorthand notation is shown in Example 30.3, “Sample IPv6 Address”, where all three lines represent the same address.

Example 30.3. Sample IPv6 Address

fe80 : 0000 : 0000 : 0000 : 0000 : 10 : 1000 : 1a4
fe80 :    0 :    0 :    0 :    0 : 10 : 1000 : 1a4
fe80 :                           : 10 : 1000 : 1a4

Each part of an IPv6 address has a defined function. The first bytes form the prefix and specify the type of address. The center part is the network portion of the address, but it may be unused. The end of the address forms the host part. With IPv6, the netmask is defined by indicating the length of the prefix after a slash at the end of the address. An address, as shown in Example 30.4, “IPv6 Address Specifying the Prefix Length”, contains the information that the first 64 bits form the network part of the address and the last 64 form its host part. In other words, the 64 means that the netmask is filled with 64 1-bit values from the left. Just like with IPv4, the IP address is combined with AND with the values from the netmask to determine whether the host is located in the same subnetwork or in another one.

Example 30.4. IPv6 Address Specifying the Prefix Length

fe80::10:1000:1a4/64

IPv6 knows about several predefined types of prefixes. Some of these are shown in Table 30.4, “Various IPv6 Prefixes”.

Table 30.4. Various IPv6 Prefixes

Prefix (hex)

Definition

00

IPv4 addresses and IPv4 over IPv6 compatibility addresses. These are used to maintain compatibility with IPv4. Their use still requires a router able to translate IPv6 packets into IPv4 packets. Several special addresses, such as the one for the loopback device, have this prefix as well.

2 or 3 as the first digit

Aggregatable global unicast addresses. As is the case with IPv4, an interface can be assigned to form part of a certain subnetwork. Currently, there are the following address spaces: 2001::/16 (production quality address space) and 2002::/16 (6to4 address space).

fe80::/10

Link-local addresses. Addresses with this prefix should not be routed and should therefore only be reachable from within the same subnetwork.

fec0::/10

Site-local addresses. These may be routed, but only within the network of the organization to which they belong. In effect, they are the IPv6 equivalent of the current private network address space, such as 10.x.x.x.

ff

These are multicast addresses.


A unicast address consists of three basic components:

Public Topology

The first part (which also contains one of the prefixes mentioned above) is used to route packets through the public Internet. It includes information about the company or institution that provides the Internet access.

Site Topology

The second part contains routing information about the subnetwork to which to deliver the packet.

Interface ID

The third part identifies the interface to which to deliver the packet. This also allows for the MAC to form part of the address. Given that the MAC is a globally unique, fixed identifier coded into the device by the hardware maker, the configuration procedure is substantially simplified. In fact, the first 64 address bits are consolidated to form the EUI-64 token, with the last 48 bits taken from the MAC, and the remaining 24 bits containing special information about the token type. This also makes it possible to assign an EUI-64 token to interfaces that do not have a MAC, such as those based on PPP or ISDN.

On top of this basic structure, IPv6 distinguishes between five different types of unicast addresses:

:: (unspecified)

This address is used by the host as its source address when the interface is initialized for the first time—when the address cannot yet be determined by other means.

::1 (loopback)

The address of the loopback device.

IPv4 Compatible Addresses

The IPv6 address is formed by the IPv4 address and a prefix consisting of 96 zero bits. This type of compatibility address is used for tunneling (see Section 30.2.3, “Coexistence of IPv4 and IPv6”) to allow IPv4 and IPv6 hosts to communicate with others operating in a pure IPv4 environment.

IPv4 Addresses Mapped to IPv6

This type of address specifies a pure IPv4 address in IPv6 notation.

Local Addresses

There are two address types for local use:

link-local

This type of address can only be used in the local subnetwork. Packets with a source or target address of this type should not be routed to the Internet or other subnetworks. These addresses contain a special prefix (fe80::/10) and the interface ID of the network card, with the middle part consisting of zero bytes. Addresses of this type are used during automatic configuration to communicate with other hosts belonging to the same subnetwork.

site-local

Packets with this type of address may be routed to other subnetworks, but not to the wider Internet—they must remain inside the organization's own network. Such addresses are used for intranets and are an equivalent of the private address space defined by IPv4. They contain a special prefix (fec0::/10), the interface ID, and a 16 bit field specifying the subnetwork ID. Again, the rest is filled with zero bytes.

As a completely new feature introduced with IPv6, each network interface normally gets several IP addresses, with the advantage that several networks can be accessed through the same interface. One of these networks can be configured completely automatically using the MAC and a known prefix with the result that all hosts on the local network can be reached as soon as IPv6 is enabled (using the link-local address). With the MAC forming part of it, any IP address used in the world is unique. The only variable parts of the address are those specifying the site topology and the public topology, depending on the actual network in which the host is currently operating.

For a host to go back and forth between different networks, it needs at least two addresses. One of them, the home address, not only contains the interface ID but also an identifier of the home network to which it normally belongs (and the corresponding prefix). The home address is a static address and, as such, it does not normally change. Still, all packets destined to the mobile host can be delivered to it, regardless of whether it operates in the home network or somewhere outside. This is made possible by the completely new features introduced with IPv6, such as stateless autoconfiguration and neighbor discovery. In addition to its home address, a mobile host gets one or more additional addresses that belong to the foreign networks where it is roaming. These are called care-of addresses. The home network has a facility that forwards any packets destined to the host when it is roaming outside. In an IPv6 environment, this task is performed by the home agent, which takes all packets destined to the home address and relays them through a tunnel. On the other hand, those packets destined to the care-of address are directly transferred to the mobile host without any special detours.

30.2.3. Coexistence of IPv4 and IPv6

The migration of all hosts connected to the Internet from IPv4 to IPv6 is a gradual process. Both protocols will coexist for some time to come. The coexistence on one system is guaranteed where there is a dual stack implementation of both protocols. That still leaves the question of how an IPv6 enabled host should communicate with an IPv4 host and how IPv6 packets should be transported by the current networks, which are predominantly IPv4 based. The best solutions offer tunneling and compatibility addresses (see Section 30.2.2, “Address Types and Structure”).

IPv6 hosts that are more or less isolated in the (worldwide) IPv4 network can communicate through tunnels: IPv6 packets are encapsulated as IPv4 packets to move them across an IPv4 network. Such a connection between two IPv4 hosts is called a tunnel. To achieve this, packets must include the IPv6 destination address (or the corresponding prefix) as well as the IPv4 address of the remote host at the receiving end of the tunnel. A basic tunnel can be configured manually according to an agreement between the hosts' administrators. This is also called static tunneling.

However, the configuration and maintenance of static tunnels is often too labor-intensive to use them for daily communication needs. Therefore, IPv6 provides for three different methods of dynamic tunneling:

6over4

IPv6 packets are automatically encapsulated as IPv4 packets and sent over an IPv4 network capable of multicasting. IPv6 is tricked into seeing the whole network (Internet) as a huge local area network (LAN). This makes it possible to determine the receiving end of the IPv4 tunnel automatically. However, this method does not scale very well and is also hampered by the fact that IP multicasting is far from widespread on the Internet. Therefore, it only provides a solution for smaller corporate or institutional networks where multicasting can be enabled. The specifications for this method are laid down in RFC 2529.

6to4

With this method, IPv4 addresses are automatically generated from IPv6 addresses, enabling isolated IPv6 hosts to communicate over an IPv4 network. However, a number of problems have been reported regarding the communication between those isolated IPv6 hosts and the Internet. The method is described in RFC 3056.

IPv6 Tunnel Broker

This method relies on special servers that provide dedicated tunnels for IPv6 hosts. It is described in RFC 3053.

30.2.4. Configuring IPv6

To configure IPv6, you do not normally need to make any changes on the individual workstations. IPv6 is enabled by default. You can disable it during installation in the network configuration step described in Section 3.14.3, “Network Configuration”. To disable or enable IPv6 on an installed system, use YaST Network Card. Do not change the method and click Next. Then select a card and click Advanced+IPv6 in the Address tab. To enable IPv6 manually, enter modprobe ipv6 as root.

Because of the autoconfiguration concept of IPv6, the network card is assigned an address in the link-local network. Normally, no routing table management takes place on a workstation. The network routers can be queried by the workstation, using the router advertisement protocol, for what prefix and gateways should be implemented. The radvd program can be used to set up an IPv6 router. This program informs the workstations which prefix to use for the IPv6 addresses and which routers. Alternatively, use zebra for automatic configuration of both addresses and routing.

Consult the ifup(8) man page to get information about how to set up various types of tunnels using the /etc/sysconfig/network files.

30.2.5. For More Information

The above overview does not cover the topic of IPv6 comprehensively. For a more in-depth look at the new protocol, refer to the following online documentation and books:

http://www.ipv6.org/

The starting point for everything about IPv6.

http://www.ipv6day.org

All information needed to start your own IPv6 network.

http://www.ipv6-to-standard.org/

The list of IPv6-enabled products.

http://www.bieringer.de/linux/IPv6/

Here, find the Linux IPv6-HOWTO and many links related to the topic.

RFC 2640

The fundamental RFC about IPv6.

IPv6 Essentials

A book describing all the important aspects of the topic is IPv6 Essentials by Silvia Hagen (ISBN 0-596-00125-8).

30.3. Name Resolution

DNS assists in assigning an IP address to one or more names and assigning a name to an IP address. In Linux, this conversion is usually carried out by a special type of software known as bind. The machine that takes care of this conversion is called a name server. The names make up a hierarchical system in which each name component is separated by dots. The name hierarchy is, however, independent of the IP address hierarchy described above.

Consider a complete name, such as earth.example.com, written in the format hostname.domain. A full name, referred to as a fully qualified domain name (FQDN), consists of a hostname and a domain name (example.com). The latter also includes the top level domain or TLD (com).

TLD assignment has become quite confusing for historical reasons. Traditionally, three-letter domain names are used in the USA. In the rest of the world, the two-letter ISO national codes are the standard. In addition to that, longer TLDs were introduced in 2000 that represent certain spheres of activity (for example, .info, .name, .museum).

In the early days of the Internet (before 1990), the file /etc/hosts was used to store the names of all the machines represented over the Internet. This quickly proved to be impractical in the face of the rapidly growing number of computers connected to the Internet. For this reason, a decentralized database was developed to store the hostnames in a widely distributed manner. This database, similar to the name server, does not have the data pertaining to all hosts in the Internet readily available, but can dispatch requests to other name servers.

The top of the hierarchy is occupied by root name servers. These root name servers manage the top level domains and are run by the Network Information Center (NIC). Each root name server knows about the name servers responsible for a given top level domain. Information about top level domain NICs is available at http://www.internic.net.

DNS can do more than just resolve hostnames. The name server also knows which host is receiving e-mails for an entire domain—the mail exchanger (MX).

For your machine to resolve an IP address, it must know about at least one name server and its IP address. Easily specify such a name server with the help of YaST. If you have a modem dial-up connection, you may not need to configure a name server manually at all. The dial-up protocol provides the name server address as the connection is made. The configuration of name server access with SUSE Linux Enterprise® is described in Chapter 33, The Domain Name System.

The protocol whois is closely related to DNS. With this program, quickly find out who is responsible for any given domain.

[Note]MDNS and .local Domain Names

The .local top level domain is treated as link-local domain by the resolver. DNS requests are send as multicast DNS requests instead of normal DNS requests. If you already use the .local domain in your nameserver configuration, you must switch this option off in /etc/host.conf. Also read the host.conf manual page.

If you want to switch off MDNS during installation, use nomdns=1 as a boot parameter.

For more information on multicast DNS, see http://www.multicastdns.org.

30.4. Configuring a Network Connection with YaST

There are many supported networking types on Linux. Most of them use different device names and the configuration files are spread over several locations in the file system. For a detailed overview of the aspects of manual network configuration, see Section 30.7, “Configuring a Network Connection Manually”.

During installation, YaST can be used to configure automatically all interfaces that have been detected. Additional hardware can be configured any time after installation in the installed system. The following sections describe the network configuration for all types of network connections supported by SUSE Linux Enterprise.

[Tip]IBM System z: Hotpluggable Network Cards

On IBM System z platforms, hotpluggable network cards are supported, but not their automatic network integration via DHCP (as is the case on the PC). After detection, manually configure the interface.

30.4.1. Configuring the Network Card with YaST

To configure your network wired or wireless card in YaST, select Network Devices+Network Card. After starting the module, YaST displays a general network configuration dialog. Choose whether to use YaST or NetworkManager to manage all your network devices. If you want to configure your network in the traditional way with the YaST, check Traditional Method with ifup and click Next. To use NetworkManager, check User Controlled with NetworkManager and click Next. Find detailed information about NetworkManager in Section 30.6, “Managing Network Connections with NetworkManager”.

[Note]Network Method and Xen

NetworkManager does not work with Xen. Only Traditional Method with ifup is available in Xen.

The upper part of the next dialog shows a list with all the network cards available for configuration. Any card properly detected is listed with its name. To change the configuration of the selected device, click Edit. Devices that could not be detected can be configured using Add as described in Section 30.4.1.2, “Configuring an Undetected Network Card”.

Figure 30.3. Configuring a Network Card

Configuring a Network Card

30.4.1.1. Changing the Configuration of a Network Card

To change the configuration of a network card, select a card from the list of the detected cards in the YaST network card configuration module and click Edit. The Network Address Setup dialog appears in which to adjust the card configuration using the Address and General tabs. For information about wireless card configuration, see Section 29.1.3, “Configuration with YaST”.

30.4.1.1.1. Configuring IP Addresses

When possible, wired network cards available during installation are automatically configured to use automatic address setup, DHCP.

[Note]IBM System z and DHCP

On IBM System z platforms, DHCP-based address configuration is only supported with network cards that have a MAC address. This is only the case with OSA and OSA Express cards.

DHCP should also be used for a DSL line with no static IP assigned by the ISP. If you decide to use DHCP, configure the details in DHCP Client Options. Find this dialog from the Address tab by selecting Advanced+DHCP Options. Specify whether the DHCP server should always honor broadcast requests and any identifier to use. If you have a virtual host setup where different hosts communicate through the same interface, an identifier is necessary to distinguish them.

DHCP is a good choice for client configuration but it is not ideal for server configuration. To set a static IP address, proceed as follows:

  1. Select a card from the list of detected cards in the YaST network card configuration module and click Edit.

  2. In the Address tab, choose Static Address Setup.

  3. Enter IP Address and Subnet Mask.

  4. Click Next.

  5. To activate the configuration, click Finish.

If you use the static address, name servers and a default gateway are not configured automatically. To configure a gateway, click Routing and add the default gateway. To configure name servers, click Hostname and Name Server and add addresses of name servers and domains.

30.4.1.1.2. Configuring Aliases

One network device can have multiple IP addresses, called aliases. To set an alias for your network card, proceed as follows:

  1. Select a card from the list of detected cards in the YaST network card configuration module and click Edit.

  2. In the Address tab, choose Advanced+Additional Addresses.

  3. Click Add.

  4. Enter Alias Name, IP Address, and Netmask.

  5. Click OK.

  6. Click OK again.

  7. Click Next.

  8. To activate the configuration, click Finish.

30.4.1.1.3. Configuring Hostname and DNS

If you did not change the network configuration during installation and the wired card was available, a hostname was automatically generated for your computer and DHCP was activated. The same applies to the name service information your host needs to integrate into a network environment. If DHCP is used for network address setup, the list of domain name servers is automatically filled with the appropriate data. If a static setup is preferred, set these values manually.

To change the name of your computer and adjust the name server search list, proceed as follows:

  1. Select a card from the list of detected cards in the YaST network card configuration module and click Edit.

  2. In the Address tab, click Hostname and Name Server.

  3. To disable DHCP-driven host name configuration, deselect Change Hostname via DHCP.

  4. Enter Hostname and, if it is needed, Domain Name.

  5. To disable DHCP driven updates of the name server list, deselect Update Name Servers and Search List via DHCP.

  6. Enter the name servers and domain search list.

  7. Click OK.

  8. Click Next.

  9. To activate the configuration, click Finish.

30.4.1.1.4. Configuring Routing

To make your machine communicate with other machines and other networks, routing information must be given to make network traffic take the correct path. If DHCP is used, this information is automatically provided. If a static setup is used, this data must be added manually.

  1. Select a card from the list of detected cards in the YaST network card configuration module and click Edit.

  2. In the Address tab, click Routing.

  3. Enter the IP of the Default Gateway.

  4. Click OK.

  5. Click Next.

  6. To activate the configuration, click Finish.

30.4.1.1.5. Adding Special Hardware Options

Sometimes a module of a network card needs special parameters to work correctly. To set them with YaST, proceed as follows:

  1. Select a card from the list of detected cards in the YaST network card configuration module and click Edit.

  2. In the Address tab, click Advanced+Hardware Details.

  3. In Options, enter the parameters for your network card. If two cards are configured that use the same module, these parameters are used for both.

  4. Click OK.

  5. Click Next.

  6. To activate configuration, click Finish.

30.4.1.1.6. Starting the Device

If you use the traditional method with ifup, you can configure your device to start during boot, on cable connection, on card detection, manually, or never. To change device start-up, proceed as follows:

  1. Select a card from the list of detected cards in the YaST network card configuration module and click Edit.

  2. In the General tab, select the desired entry from Device Activation.

  3. Click Next.

  4. To activate the configuration, click Finish.

30.4.1.1.7. Configuring the Firewall

Without having to enter the detailed firewall setup as described in Section 43.4.1, “Configuring the Firewall with YaST”, you can determine the basic firewall setup for your device as part of the device setup. Proceed as follows:

  1. Select a card from the list of detected cards in the YaST network card configuration module and click Edit.

  2. Enter the General tab of the network configuration dialog.

  3. Determine the firewall zone to which your interface should be assigned. The following options are available:

    No Zone, All Traffic Blocked

    All traffic will be blocked for this interface.

    Internal Zone (Unprotected)

    The firewall is run, but does not enforce any rules to protect this interface. Only use this option, if your machine is part of a greater network that is protected by an outer firewall.

    Demilitarized Zone

    A demilitarized zone is an additional line of defense in front of an internal network and the (hostile) Internet. Hosts assigned to this zone can be reached from the internal network and from the Internet, but cannot access the internal network.

    External Zone

    The firewall is run on this interface and fully protects it against other (presumably hostile) network traffic. This is the default option.

  4. Click Next.

  5. Activate the configuration by clicking Finish.

30.4.1.2. Configuring an Undetected Network Card

It may happen that your card is not detected correctly. In this case, the card is not included in the list of the detected cards. If you are sure that your system includes a driver for your card, you can configure it manually. To configure an undetected network card, proceed as follows:

  1. Click Add.

  2. Set the Device Type of the interface from the available options, Configuration Name, and Module Name. If the network card is a PCMCIA or USB device, activate the respective check box and exit this dialog with Next. Otherwise, select your network card model from Select from List. YaST then automatically selects the appropriate kernel module for the card.

    Hardware Configuration Name specifies the name of the /etc/sysconfig/hardware/hwcfg-* file containing the hardware settings of your network card. This contains the name of the kernel module as well as the options needed to initialize the hardware.

  3. Click Next.

  4. In the Address tab, set the device type of the interface, the configuration name, and IP address. To use a static address, choose Static Address Setup then complete IP Address and Subnet Mask. Here, you can also select to configure the hostname, name server, and routing details (see Section 30.4.1.1.3, “Configuring Hostname and DNS” and Section 30.4.1.1.4, “Configuring Routing”).

    If you selected Wireless as the device type of the interface, configure the wireless connection in the next dialog. Detailed information about wireless device configuration is available in Section 29.1, “Wireless LAN”.

  5. In the General tab, set the Firewall Zone and Device Activation. With User Controlled, grant connection control to ordinary users.

  6. Click Next.

  7. To activate the new network configuration, click Finish.

Information about the conventions for configuration names is available in the getcfg(8) man page.

30.4.2. Modem

[Tip]IBM System z: Modem

The configuration of this type of hardware is not supported on IBM System z platforms.

In the YaST Control Center, access the modem configuration with Network Devices+Modem. If your modem was not automatically detected, open the dialog for manual configuration by clicking Add. In the dialog that opens, enter the interface to which the modem is connected for Modem Device.

[Tip]CDMA and GPRS Modems

Configure supported CDMA and GPRS modems with the YaST modem module just as you would configure regular modems.

Figure 30.4. Modem Configuration

Modem Configuration

If behind a private branch exchange (PBX), you may need to enter a dial prefix. This is often a zero. Consult the instructions that came with the PBX to find out. Also select whether to use tone or pulse dialing, whether the speaker should be on, and whether the modem should wait until it detects a dial tone. The last option should not be enabled if the modem is connected to an exchange.

Under Details, set the baud rate and the modem initialization strings. Only change these settings if your modem was not detected automatically or if it requires special settings for data transmission to work. This is mainly the case with ISDN terminal adapters. Leave this dialog by clicking OK. To delegate control over the modem to the normal user without root permissions, activate User Controlled. In this way, a user without administrator permissions can activate or deactivate an interface. Under Dial Prefix Regular Expression, specify a regular expression. The Dial Prefix in KInternet, which can be modified by the normal user, must match this regular expression. If this field is left empty, the user cannot set a different Dial Prefix without administrator permissions.

In the next dialog, select the ISP (Internet service provider). To choose from a predefined list of ISPs operating in your country, select Country. Alternatively, click New to open a dialog in which to provide the data for your ISP. This includes a name for the dial-up connection and ISP as well as the login and password provided by your ISP. Enable Always Ask for Password to be prompted for the password each time you connect.

In the last dialog, specify additional connection options:

Dial on Demand

If you enable dial on demand, set at least one name server.

Modify DNS when Connected

This option is enabled by default, with the effect that the name server address is updated each time you connect to the Internet.

Automatically Retrieve DNS

If the provider does not transmit its domain name server after connecting, disable this option and enter the DNS data manually.

Stupid Mode

This option is enabled by default. With it, input prompts sent by the ISP's server are ignored to prevent them from interfering with the connection process.

External Firewall Interface

Selecting this option activates the SUSEfirewall2 and sets the interface as external. This way, the system protected from outside attacks for the duration of your Internet connection.

Idle Time-Out (seconds)

With this option, specify a period of network inactivity after which the modem disconnects automatically.

IP Details

This opens the address configuration dialog. If your ISP does not assign a dynamic IP address to your host, disable Dynamic IP Address then enter your host's local IP address and the remote IP address. Ask your ISP for this information. Leave Default Route enabled and close the dialog by selecting OK.

Selecting Next returns to the original dialog, which displays a summary of the modem configuration. Close this dialog with Finish.

30.4.3. ISDN

[Tip]IBM System z: ISDN

The configuration of this type of hardware is not supported on IBM System z platforms.

Use this module to configure one or several ISDN cards for your system. If YaST did not detect your ISDN card, click Add and manually select it. Multiple interfaces are possible, but several ISPs can be configured for one interface. In the subsequent dialogs, set the ISDN options necessary for the proper functioning of the card.

Figure 30.5. ISDN Configuration

ISDN Configuration

In the next dialog, shown in Figure 30.5, “ISDN Configuration”, select the protocol to use. The default is Euro-ISDN (EDSS1), but for older or larger exchanges, select 1TR6. If you are in the US, select NI1. Select your country in the relevant field. The corresponding country code then appears in the field next to it. Finally, provide your Area Code and the Dial Prefix if necessary.

Device Activation defines how the ISDN interface should be started: At Boot Time causes the ISDN driver to be initialized each time the system boots. Manually requires you to load the ISDN driver as root with the command rcisdn start. On Hotplug, used for PCMCIA or USB devices, loads the driver after the device is plugged in. When finished with these settings, select OK.

In the next dialog, specify the interface type for your ISDN card and add ISPs to an existing interface. Interfaces may be either the SyncPPP or the RawIP type, but most ISPs operate in the SyncPPP mode, which is described below.

Figure 30.6. ISDN Interface Configuration

ISDN Interface Configuration

The number to enter for My Phone Number depends on your particular setup:

ISDN Card Directly Connected to Phone Outlet

A standard ISDN line provides three phone numbers (called multiple subscriber numbers, or MSNs). If the subscriber asked for more, there may be up to 10. One of these MSNs must be entered here, but without your area code. If you enter the wrong number, your phone operator automatically falls back to the first MSN assigned to your ISDN line.

ISDN Card Connected to a Private Branch Exchange

Again, the configuration may vary depending on the equipment installed:

  1. Smaller private branch exchanges (PBX) built for home purposes mostly use the Euro-ISDN (EDSS1) protocol for internal calls. These exchanges have an internal S0 bus and use internal numbers for the equipment connected to them.

    Use one of the internal numbers as your MSN. You should be able to use at least one of the exchange's MSNs that have been enabled for direct outward dialing. If this does not work, try a single zero. For further information, consult the documentation that came with your phone exchange.

  2. Larger phone exchanges designed for businesses normally use the 1TR6 protocol for internal calls. Their MSN is called EAZ and usually corresponds to the direct-dial number. For the configuration under Linux, it should be sufficient to enter the last digit of the EAZ. As a last resort, try each of the digits from 1 to 9.

For the connection to be terminated just before the next charge unit is due, enable ChargeHUP. However, remember that may not work with every ISP. You can also enable channel bundling (multilink PPP) by selecting the corresponding option. Finally, you can enable SuSEfirewall2 for your link by selecting External Firewall Interface and Restart Firewall. To enable the normal user without administrator permissions to activate or deactivate the interface, select the User Controlled.

Details opens a dialog in which to configure callback mode, remote connections to this interface and additional ippd options. Leave the Details dialog by selecting OK.

In the next dialog, make IP address settings. If you have not been given a static IP by your provider, select Dynamic IP Address. Otherwise, use the fields provided to enter your host's local IP address and the remote IP address according to the specifications of your ISP. If the interface should be the default route to the Internet, select Default Route. Each host can only have one interface configured as the default route. Leave this dialog by selecting Next.

The following dialog allows you to set your country and select an ISP. The ISPs included in the list are call-by-call providers only. If your ISP is not in the list, select New. This opens the Provider Parameters dialog in which to enter all the details for your ISP. When entering the phone number, do not include any blanks or commas among the digits. Finally, enter your login and the password as provided by the ISP. When finished, select Next.

To use Dial on Demand on a stand-alone workstation, also specify the name server (DNS server). Most ISPs support dynamic DNS, which means the IP address of a name server is sent by the ISP each time you connect. For a single workstation, however, you still need to provide a placeholder address like 192.168.22.99. If your ISP does not support dynamic DNS, specify the name server IP addresses of the ISP. If desired, specify a time-out for the connection—the period of network inactivity (in seconds) after which the connection should be automatically terminated. Confirm your settings with Next. YaST displays a summary of the configured interfaces. To make all these settings active, select Finish.

30.4.4. Cable Modem

[Tip]IBM System z: Cable Modem

The configuration of this type of hardware is not supported on IBM System z platforms.

In some countries, such as Austria and the US, it is quite common to access the Internet through the TV cable network. The TV cable subscriber usually gets a modem that is connected to the TV cable outlet on one side and to a computer network card on the other (using a 10Base-TG twisted pair cable). The cable modem then provides a dedicated Internet connection with a fixed IP address.

Depending on the instructions provided by your ISP, when configuring the network card either select Automatic Address Setup (via DHCP) or Static Address Setup. Most providers today use DHCP. A static IP address often comes as part of a special business account.

For further information about the configuration of cable modems, read the Support Database article on the topic, which is available online at http://old-en.opensuse.org/SDB:Setting_Up_an_Internet_Connection_via_Cable_Modem_with_SuSE_Linux_8.0_or_Higher.

30.4.5. DSL

[Tip]IBM System z: DSL

The configuration of this type of hardware is not supported on IBM System z platforms.

To configure your DSL device, select the DSL module from the YaST Network Devices section. This YaST module consists of several dialogs in which to set the parameters of DSL links based on one of the following protocols:

  • PPP over Ethernet (PPPoE)

  • PPP over ATM (PPPoATM)

  • CAPI for ADSL (Fritz Cards)

  • Point-to-Point Tunneling Protocol (PPTP)—Austria

The configuration of a DSL connection based on PPPoE or PPTP requires that the corresponding network card has already been set up in the correct way. If you have not done so yet, first configure the card by selecting Configure Network Cards (see Section 30.4.1, “Configuring the Network Card with YaST”). In the case of a DSL link, addresses may be assigned automatically but not via DHCP, which is why you should not enable the option Automatic address setup (via DHCP). Instead, enter a static dummy address for the interface, such as 192.168.22.1. In Subnet Mask, enter 255.255.255.0. If you are configuring a stand-alone workstation, leave Default Gateway empty.

[Tip]

Values in IP Address and Subnet Mask are only placeholders. They are only needed to initialize the network card and do not represent the DSL link as such.

Figure 30.7. DSL Configuration

DSL Configuration

To begin the DSL configuration (see Figure 30.7, “DSL Configuration”), first select the PPP mode and the ethernet card to which the DSL modem is connected (in most cases, this is eth0). Then use Device Activation to specify whether the DSL link should be established during the boot process. Click User Controlled to authorize the normal user without root permissions to activate or deactivate the interface with KInternet. The dialog also lets you select your country and choose from a number of ISPs operating in it. The details of any subsequent dialogs of the DSL configuration depend on the options set so far, which is why they are only briefly mentioned in the following paragraphs. For details on the available options, read the detailed help available from the dialogs.

To use Dial on Demand on a stand-alone workstation, also specify the name server (DNS server). Most ISPs support dynamic DNS—the IP address of a name server is sent by the ISP each time you connect. For a single workstation, however, provide a placeholder address like 192.168.22.99. If your ISP does not support dynamic DNS, enter the name server IP address provided by your ISP.

Idle Time-Out (seconds) defines a period of network inactivity after which to terminate the connection automatically. A reasonable time-out value is between 60 and 300 seconds. If Dial on Demand is disabled, it may be useful to set the time-out to zero to prevent automatic hang-up.

The configuration of T-DSL is very similar to the DSL setup. Just select T-Online as your provider and YaST opens the T-DSL configuration dialog. In this dialog, provide some additional information required for T-DSL—the line ID, the T-Online number, the user code, and your password. All of these should be included in the information you received after subscribing to T-DSL.

30.4.6. IBM System z: Configuring Network Devices

SUSE Linux Enterprise for IBM System z supports several different types of network interfaces. YaST can be used to configure all of them.

30.4.6.1. The qeth-hsi Device

To add a qeth-hsi (Hipersockets) interface to the installed system, start the YaST network card module (Network Devices+Network Card). Select one of the devices marked IBM Hipersocket to use as the READ device address and click Configure. In the Network address setup dialog, specify the IP address and netmask for the new interface and leave the network configuration by pressing Next and Finish.

30.4.6.2. The qeth-ethernet Device

To add a qeth-ethernet (IBM OSA Express Ethernet Card) interface to the installed system, start the YaST network card module (Network Devices+Network Card). Select one of the devices marked IBM OSA Express Ethernet Card to use as the READ device address and click Configure. Enter the needed port name, some additional options (see the Linux for IBM System z: Device Drivers, Features, and Commands manual for reference at http://www.ibm.com/developerworks/linux/linux390/documentation_novell_suse.html), your IP address, and an appropriate netmask. Leave the network configuration with Next and Finish.

30.4.6.3. The ctc Device

To add a ctc (IBM parallel CTC Adapter) interface to the installed system, start the YaST network card module (Network Devices+Network Card). Select one of the devices marked IBM parallel CTC Adapter to use as your read channel and click Configure. Choose the Device Settings that fit your devices (usually this would be Compatibility mode). Specify both your IP address and the IP address of the remote partner. If needed, adjust the MTU size with Advanced+Detailed Settings. Leave the network configuration with Next and Finish.

[Warning]

The use of this interface is deprecated. This interface will not be supported in future versions of SUSE Linux Enterprise.

30.4.6.4. The lcs Device

To add an lcs (IBM OSA-2 Adapter) interface to the installed system, start the YaST network card module (Network Devices+Network Card). Select one of the devices marked IBM OSA-2 Adapter and click Configure. Enter the needed port number, some additional options (see the Linux for IBM System z: Device Drivers, Features, and Commands manual for reference at http://www.ibm.com/developerworks/linux/linux390/documentation_novell_suse.html), your IP address, and an appropriate netmask. Leave the network configuration with Next and Finish.

30.4.6.5. The IUCV Device

To add an iucv (IUCV) interface to the installed system, start the YaST network card module (Network Devices+Network Card). Select a device marked IUCV and click Configure. YaST prompts you for the name of your IUCV partner. Enter the name (this entry is case-sensitive) and select Next. Specify both your IP address and the IP address of your partner. If needed, adjust the MTU size with Advanced+Detailed Settings. Leave the network configuration with Next and Finish.

[Warning]

The use of this interface is deprecated. This interface will not be supported in future versions of SUSE Linux Enterprise.

30.5. Configuring VLAN Interfaces on SUSE Linux

VLAN is an abbreviation of Virtual Local Area Network. It allows the running of multiple logical (virtual) ethernets over one single physical ethernet. It logically splits the network into different broadcast domains so that packets are only switched between ports that are designated for the same VLAN. If you intend to use VLAN in your network setup, make sure that the package vlan is installed.

If the network connection of Linux is not dedicated to a specific logical LAN, you can set up access to one or more of these logical LANs. The VLAN interface configuration is supported via the normal ifup and ifdown scripts used for all other network interfaces, as well. The setup of VLAN devices is supported by YaST.

Figure 30.8. The YaST VLAN Configuration

The YaST VLAN Configuration

Run the YaST module Network Devices+Network Card, select Traditional Method with ifup and press Next. Follow this procedure to actually setup the VLAN device:

Procedure 30.1. Setting up VLAN Interfaces with YaST

  1. Press Add to create a new network interface.

  2. In Network Configuration, select Device Type Virtual Lan.

  3. Change the value of Configuration Name to the ID of your VLAN. Note that VLAN ID 1 is commonly used for managing purposes.

  4. Press Next.

  5. Select the interface that the VLAN device should connect to below Real Interface for VLAN.

  6. Select the desired method for assigning an IP address to the VLAN device.

  7. Press Next to finish the configuration.

For more information about VLAN, see http://www.candelatech.com/~greear/vlan.html and the package documentation found at /usr/share/doc/packages/vlan/.

30.6. Managing Network Connections with NetworkManager

NetworkManager is the ideal solution for a mobile workstation. With NetworkManager, you do not need to worry about reconfiguring network interfaces and switching between networks when your location changes. NetworkManager can automatically connect to known WLAN networks. If you have two or more connection possibilities, it can connect to the faster one.

NetworkManager is not a suitable solution in the following cases:

  • You want to use more than one provider for dial-up for one interface.

  • Your computer is a router for your network.

  • Your computer provides network services for other computers in your network, for example, it is a DHCP or DNS server.

  • Your computer is a Xen server or your system is a virtual system inside Xen.

  • You want to use SCPM for network configuration management. To use SCPM and NetworkManager at the same time, SCPM cannot control network resources. .

  • You want to use more than one active network connection simultaneously.

To enable or disable NetworkManager during the installation, click Enable NetworkManager or Disable NetworkManager in Network Mode of Network Configuration. To enable or disable NetworkManager on an installed system, follow these steps:

  1. Open YaST.

  2. Choose Network Devices+Network Card.

  3. On the first screen, set the Network Setup Method option to User Controlled with NetworkManager to use NetworkManager. To disable NetworkManager, set the Network Setup Method option to Traditional Method with ifup.

After choosing the method, set up your network card using automatic configuration via DHCP or a static IP address or configure your modem. Find a detailed description of the network configuration with YaST in Section 30.4, “Configuring a Network Connection with YaST” and Section 29.1, “Wireless LAN”. Configure supported wireless cards directly in NetworkManager.

To configure NetworkManager, use NetworkManager applets. KDE and GNOME each have their own applets for NetworkManager. An appropriate applet should start automatically with the desktop environment. The applet is then shown as an icon in the system tray. The functions of the applets are similar, but their interfaces are a little different. They can also be used in other graphical environments with standard system tray support.

30.6.1. Differences between ifup and NetworkManager

If you use NetworkManager for network setup, you can easily switch, stop, or start your network connection at any time from within your desktop environment using an applet. NetworkManager also makes it possible to change and configure wireless card connections without requiring root privileges. For this reason, NetworkManager is the ideal solution for a mobile workstation.

Traditional configuration with ifup also provides some ways to switch, stop, or start the connection with or without user intervention, like user-managed devices, but it always requires root privileges to change or configure a network device. This is often a problem for mobile computing, where is not possible to preconfigure all connection possibilities.

Both traditional configuration and NetworkManager can handle network connections with a wireless network (with WEP, WPA-PSK, and WPA-Enterprise access), dial-up, and wired networks both using DHCP and static configuration. They also support connection through VPN.

NetworkManager tries to keep your computer connected at all times using the best connection available. If available, it uses the fastest wired connection. If the network cable is accidentally disconnected, it tries to reconnect. It can find a network with the best signal strength from the list of your wireless connections and automatically use it to connect. To get the same functionality with ifup, a great deal of configuration effort is required.

30.6.2. For More Information

Find more information about NetworkManager on the following Web sites and directories:

30.7. Configuring a Network Connection Manually

Manual configuration of the network software should always be the last alternative. Using YaST is recommended. However, this background information about the network configuration can also assist your work with YaST.

All built-in network cards and hotplug network cards (PCMCIA, USB, some PCI cards) are detected and configured via hotplug. The system sees a network card in two different ways: first as a physical device and second as an interface. The insertion or detection of a device triggers a hotplug event. This hotplug event triggers the initialization of the device with the script hwup. When the network card is initialized as a new network interface, the kernel generates another hotplug event that triggers the setup of the interface with ifup.

The kernel numbers interface names according to the temporal order of their registration. The initialization sequence is decisive for the assignment of names. If one of several network card fails, the numbering of all subsequently initialized cards is shifted. For real hotpluggable cards, the order in which the devices are connected is what matters.

To achieve a flexible configuration, the configuration of the device (hardware) and the interface has been separated and the mapping of configurations to devices and interfaces is no longer managed on the basis of the interface names. The device configurations are located in /etc/sysconfig/hardware/hwcfg-*. The interface configurations are located in /etc/sysconfig/network/ifcfg-*. The names of the configurations are assigned in such a way that they describe the devices and interfaces with which they are associated. Because the former mapping of drivers to interface name required static interface names, this mapping can no longer take place in /etc/modprobe.conf. In the new concept, alias entries in this file would cause undesirable side effects.

The configuration names—everything after hwcfg- or ifcfg-—can describe the devices by means of the slot, a device-specific ID, or the interface name. For example, the configuration name for a PCI card could be bus-pci-0000:02:01.0 (PCI slot) or vpid-0x8086-0x1014-0x0549 (vendor and product ID). The name of the associated interface could be bus-pci-0000:02:01.0 or wlan-id-00:05:4e:42:31:7a (MAC address).

To assign a certain network configuration to any card of a certain type (of which only one is inserted at a time) instead of a certain card, select less specific configuration names. For example, bus-pcmcia would be used for all PCMCIA cards. On the other hand, the names can be limited by a preceding interface type. For example, wlan-bus-usb would be assigned to WLAN cards connected to a USB port.

The system always uses the configuration that best describes an interface or the device providing the interface. The search for the most suitable configuration is handled by getcfg. The output of getcfg delivers all information that can be used for describing a device. Details regarding the specification of configuration names are available in the manual page of getcfg.

With the described method, a network interface is configured with the correct configuration even if the network devices are not always initialized in the same order. However, the name of the interface still depends on the initialization sequence. There are two ways to ensure reliable access to the interface of a certain network card:

  • getcfg-interface configuration name returns the name of the associated network interface. Therefore, the configuration name, such as firewall, dhcpd, routing, or various virtual network interfaces (tunnels), can be entered in some configuration files instead of the interface name, which is not persistent.

  • Persistent interface names are assigned to each interface automatically. You may adjust them to suit your needs. When creating interface names, proceed as outlined in /etc/udev/rules.d/30-net_persistent_names.rules. However, the persistent name pname should not be the same as the name that would automatically be assigned by the kernel. Therefore, eth*, tr*, wlan*, qeth*, iucv*, and so on are not permitted. Instead, use net* or descriptive names like external, internal, or dmz. Make sure that the same interface name is not used twice. Allowed characters in interface names are restricted to [a-zA-Z0-9]. A persistent name can only be assigned to an interface immediately after its registration, which means that the driver of the network card must be reloaded or hwup device description must be executed. The command rcnetwork restart is not sufficient for this purpose.

    [Important]Using Persistent Interface Names

    The use of persistent interface names has not been tested in all areas. Therefore, some applications may not be able to handle freely selected interface names.

ifup requires an existing interface, because it does not initialize the hardware. The initialization of the hardware is handled by the command hwup (executed by hotplug or coldplug). When a device is initialized, ifup is automatically executed for the new interface via hotplug and the interface is set up if the start mode is onboot, hotplug, or auto and the network service was started. Formerly, the command ifup interfacename triggered the hardware initialization. Now the procedure has been reversed. First, a hardware component is initialized then all other actions follow. In this way, a varying number of devices can always be configured in the best way possible with an existing set of configurations.

Table 30.5, “Manual Network Configuration Scripts” summarizes the most important scripts involved in the network configuration. Where possible, the scripts are distinguished by hardware and interface.

Table 30.5. Manual Network Configuration Scripts

Configuration Stage

Command

Function

Hardware

hw{up,down,status}

The hw* scripts are executed by the hotplug subsystem to initialize a device, undo the initialization, or query the status of a device. More information is available in the manual page of hwup.

Interface

getcfg

getcfg can be used to query the interface name associated with a configuration name or a hardware description. More information is available in the manual page of getcfg.

Interface

if{up,down,status}

The if* scripts start existing network interfaces or return the status of the specified interface. More information is available in the manual page of ifup.


More information about hotplug and persistent device names is available in Chapter 24, Dynamic Kernel Device Management with udev.

30.7.1. Configuration Files

This section provides an overview of the network configuration files and explains their purpose and the format used.

30.7.1.1. /etc/syconfig/hardware/hwcfg-*

These files contain the hardware configurations of network cards and other devices. They contain the needed parameters, such as the kernel module, start mode, and script associations. Refer to the manual page of hwup for details. Regardless of the existing hardware, the hwcfg-static-* configurations are applied when coldplug is started.

30.7.1.2. /etc/sysconfig/network/ifcfg-*

These files contain the configurations for network interface. They include information such as the start mode and the IP address. Possible parameters are described in the manual page of ifup. Additionally, all variables from the files dhcp, wireless, and config can be used in the ifcfg-* files if a general setting should be used for only one interface.

►zseries: IBM System z do not support USB. The names of the interface files and network aliases contain System z-specific elements like qeth.

30.7.1.3. /etc/sysconfig/network/{config,dhcp,wireless}

The file config contains general settings for the behavior of ifup, ifdown, and ifstatus. dhcp contains settings for DHCP and wireless for wireless LAN cards. The variables in all three configuration files are commented and can also be used in ifcfg-* files, where they are treated with higher priority.

30.7.1.4. /etc/sysconfig/network/{routes,ifroute-*}

The static routing of TCP/IP packets is determined here. All the static routes required by the various system tasks can be entered in the /etc/sysconfig/network/routes file: routes to a host, routes to a host via a gateway, and routes to a network. For each interface that needs individual routing, define an additional configuration file: /etc/sysconfig/network/ifroute-*. Replace * with the name of the interface. The entries in the routing configuration files look like this:

# Destination     Dummy/Gateway     Netmask            Device
#
127.0.0.0         0.0.0.0           255.255.255.0      lo
204.127.235.0     0.0.0.0           255.255.255.0      eth0
default           204.127.235.41    0.0.0.0            eth0
207.68.156.51     207.68.145.45     255.255.255.255    eth1
192.168.0.0       207.68.156.51     255.255.0.0        eth1

The route's destination is in the first column. This column may contain the IP address of a network or host or, in the case of reachable name servers, the fully qualified network or hostname.

The second column contains the default gateway or a gateway through which a host or network can be accessed. The third column contains the netmask for networks or hosts behind a gateway. For example, the mask is 255.255.255.255 for a host behind a gateway.

The fourth column is only relevant for networks connected to the local host such as loopback, Ethernet, ISDN, PPP, and dummy device. The device name must be entered here.

An (optional) fifth column can be used to specify the type of a route. Columns that are not needed should contain a minus sign - to ensure that the parser correctly interprets the command. For details, refer to the routes(5) man page.

30.7.1.5. /etc/resolv.conf

The domain to which the host belongs is specified in this file (keyword search). Also listed is the status of the name server address to access (keyword nameserver). Multiple domain names can be specified. When resolving a name that is not fully qualified, an attempt is made to generate one by attaching the individual search entries. Use multiple name servers by entering several lines, each beginning with nameserver. Precede comments with # signs. YaST enters the specified name server in this file. Example 30.5, “/etc/resolv.conf shows what /etc/resolv.conf could look like.

Example 30.5. /etc/resolv.conf

# Our domain
search example.com
#
# We use sun (192.168.0.20) as nameserver
nameserver 192.168.0.20

Some services, like pppd (wvdial), ipppd (isdn), dhcp (dhcpcd and dhclient), pcmcia, and hotplug, modify the file /etc/resolv.conf by means of the script modify_resolvconf. If the file /etc/resolv.conf has been temporarily modified by this script, it contains a predefined comment giving information about the service that modified it, the location where the original file has been backed up, and how to turn off the automatic modification mechanism. If /etc/resolv.conf is modified several times, the file includes modifications in a nested form. These can be reverted in a clean way even if this reversal takes place in an order different from the order in which modifications were introduced. Services that may need this flexibility include isdn, pcmcia, and hotplug.

If a service was not terminated in a normal, clean way, modify_resolvconf can be used to restore the original file. Also, on system boot, a check is performed to see whether there is an uncleaned, modified resolv.conf, for example, after a system crash, in which case the original (unmodified) resolv.conf is restored.

YaST uses the command modify_resolvconf check to find out whether resolv.conf has been modified and subsequently warns the user that changes will be lost after restoring the file. Apart from this, YaST does not rely on modify_resolvconf, which means that the impact of changing resolv.conf through YaST is the same as that of any manual change. In both cases, changes have a permanent effect. Modifications requested by the mentioned services are only temporary.

30.7.1.6.  /etc/hosts

In this file, shown in Example 30.6, “/etc/hosts, IP addresses are assigned to hostnames. If no name server is implemented, all hosts to which an IP connection will be set up must be listed here. For each host, enter a line consisting of the IP address, the fully qualified hostname, and the hostname into the file. The IP address must be at the beginning of the line and the entries separated by blanks and tabs. Comments are always preceded by the # sign.

Example 30.6. /etc/hosts


127.0.0.1 localhost
192.168.0.20 sun.example.com sun
192.168.0.1 earth.example.com earth

30.7.1.7. /etc/networks

Here, network names are converted to network addresses. The format is similar to that of the hosts file, except the network names precede the addresses. See Example 30.7, “/etc/networks.

Example 30.7. /etc/networks


loopback     127.0.0.0
localnet     192.168.0.0

30.7.1.8. /etc/host.conf

Name resolution—the translation of host and network names via the resolver library—is controlled by this file. This file is only used for programs linked to libc4 or libc5. For current glibc programs, refer to the settings in /etc/nsswitch.conf. A parameter must always stand alone in its own line. Comments are preceded by a # sign. Table 30.6, “Parameters for /etc/host.conf” shows the parameters available. A sample /etc/host.conf is shown in Example 30.8, “ /etc/host.conf.

Table 30.6. Parameters for /etc/host.conf

order hosts, bind

Specifies in which order the services are accessed for the name resolution. Available arguments are (separated by blank spaces or commas):

hosts: Searches the /etc/hosts file

bind: Accesses a name server

nis: Uses NIS

multi on/off

Defines if a host entered in /etc/hosts can have multiple IP addresses.

nospoof on spoofalert on/off

These parameters influence the name server spoofing, but, apart from that, do not exert any influence on the network configuration.

trim domainname

The specified domain name is separated from the hostname after hostname resolution (as long as the hostname includes the domain name). This option is useful if only names from the local domain are in the /etc/hosts file, but should still be recognized with the attached domain names.


Example 30.8.  /etc/host.conf


# We have named running
order hosts bind
# Allow multiple addrs
multi on

30.7.1.9. /etc/nsswitch.conf

The introduction of the GNU C Library 2.0 was accompanied by the introduction of the Name Service Switch (NSS). Refer to the nsswitch.conf(5) man page and The GNU C Library Reference Manual for details.

The order for queries is defined in the file /etc/nsswitch.conf. A sample nsswitch.conf is shown in Example 30.9, “/etc/nsswitch.conf. Comments are introduced by # signs. In this example, the entry under the hosts database means that a request is sent to /etc/hosts (files) via DNS (see Chapter 33, The Domain Name System).

Example 30.9. /etc/nsswitch.conf


passwd:     compat
group:      compat

hosts:      files dns
networks:   files dns

services:   db files
protocols:  db files

netgroup:   files
automount:  files nis

The databases available over NSS are listed in Table 30.7, “Databases Available via /etc/nsswitch.conf”. In addition, automount, bootparams, netmasks, and publickey are expected in the near future. The configuration options for NSS databases are listed in Table 30.8, “Configuration Options for NSS Databases.

Table 30.7. Databases Available via /etc/nsswitch.conf

aliases

Mail aliases implemented by sendmail; see man 5 aliases.

ethers

Ethernet addresses.

group

For user groups, used by getgrent. See also the man page for group.

hosts

For hostnames and IP addresses, used by gethostbyname and similar functions.

netgroup

Valid host and user lists in the network for the purpose of controlling access permissions; see the netgroup(5) man page.

networks

Network names and addresses, used by getnetent.

passwd

User passwords, used by getpwent; see the passwd(5) man page.

protocols

Network protocols, used by getprotoent; see the protocols(5) man page.

rpc

Remote procedure call names and addresses, used by getrpcbyname and similar functions.

services

Network services, used by getservent.

shadow

Shadow passwords of users, used by getspnam; see the shadow(5) man page.


Table 30.8. Configuration Options for NSS Databases

files

directly access files, for example, /etc/aliases

db

access via a database

nis, nisplus

NIS, see also Chapter 35, Using NIS

dns

can only be used as an extension for hosts and networks

compat

can only be used as an extension for passwd, shadow, and group


30.7.1.10. /etc/nscd.conf

This file is used to configure nscd (name service cache daemon). See the nscd(8) and nscd.conf(5) man pages. By default, the system entries of passwd and groups are cached by nscd. This is important for the performance of directory services, like NIS and LDAP, because otherwise the network connection needs to be used for every access to names or groups. hosts is not cached by default, because the mechanism in nscd to cache hosts makes the local system unable to trust forward and reverse lookup checks. Instead of asking nscd to cache names, set up a caching DNS server.

If the caching for passwd is activated, it usually takes about fifteen seconds until a newly added local user is recognized. Reduce this waiting time by restarting nscd with the command rcnscd restart.

30.7.1.11. /etc/HOSTNAME

This contains the hostname without the domain name attached. This file is read by several scripts while the machine is booting. It may only contain one line in which the hostname is set.

30.7.2. Testing the Configuration

Before you write your configuration to the configuration files, you can test it. To set up a test configuration, use the ip command. To test the connection, use the ping command. Older configuration tools, ifconfig and route, are also available.

The commands ip, ifconfig, and route change the network configuration directly without saving it in the configuration file. Unless you enter your configuration in the correct configuration files, the changed network configuration is lost on reboot.

30.7.2.1. Configuring a Network Interface with ip

ip is a tool to show and configure routing, network devices, policy routing, and tunnels. It was designed as a replacement for the older tools ifconfig and route.

ip is a very complex tool. Its common syntax is ip options object command. You can work with the following objects:

link

This object represents a network device.

address

This object represents the IP address of device.

neighbour

This object represents a ARP or NDISC cache entry.

route

This object represents the routing table entry.

rule

This object represents a rule in the routing policy database.

maddress

This object represents a multicast address.

mroute

This object represents a multicast routing cache entry.

tunnel

This object represents a tunnel over IP.

If no command is given, the default command is used, usually list.

Change the state of a device with the command ip link set device_name command. For example, to deactivate device eth0, enter ip link seteth0 down. To activate it again, use ip link seteth0 up.

After activating a device, you can configure it. To set the IP address, use ip addr add ip_address + dev device_name. For example, to set the address of the interface eth0 to 192.168.12.154/30 with standard broadcast (option brd), enter ip addr add 192.168.12.154/30 brd + dev eth0.

To have a working connection, you must also configure the default gateway. To set a gateway for your system, enter ip route get gateway_ip_address. To translate one IP address to another, use nat: ip route add nat ip_address via other_ip_address.

To display all devices, use ip link ls. To display the running interfaces only, use ip link ls up. To print interface statistics for a device, enter ip -s link ls device_name. To view addresses of your devices, enter ip addr. In the output of the ip addr, also find information about MAC addresses of your devices. To show all routes, use ip route show.

For more information about using ip, enter ip help or see the ip(8) man page. The help option is also available for all ip objects. If, for example, you want to read help for ip addr, enter ip addr help. Find the ip manual in /usr/share/doc/packages/iproute2/ip-cref.pdf.

30.7.2.2. Testing a Connection with ping

The ping command is the standard tool for testing whether a TCP/IP connection works. It uses the ICMP protocol to send a small data packet, ECHO_REQUEST datagram, to the destination host, requesting an immediate reply. If this works, ping displays a message to that effect, which indicates that the network link is basically functioning.

ping does more than test only the function of the connection between two computers: it also provides some basic information about the quality of the connection. In Example 30.10, “Output of the Command ping”, you can see an example of the ping output. The second-to-last line contains information about number of transmitted packets, packet loss, and total time of ping running.

As the destination, you can use a hostname or IP address, for example, ping example.com or ping 130.57.5.75. The program sends packets until you press Ctrl+C.

If you only need to check the functionality of the connection, you can limit the number of the packets with the -c option. For example to limit ping to three packets, enter ping -c 3 192.168.0.

Example 30.10. Output of the Command ping

ping -c 3 example.com
PING example.com (130.57.5.75) 56(84) bytes of data.
64 bytes from example.com (130.57.5.75): icmp_seq=1 ttl=49 time=188 ms
64 bytes from example.com (130.57.5.75): icmp_seq=2 ttl=49 time=184 ms
64 bytes from example.com (130.57.5.75): icmp_seq=3 ttl=49 time=183 ms
--- example.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2007ms
rtt min/avg/max/mdev = 183.417/185.447/188.259/2.052 ms

The default interval between two packets is one second. To change the interval, ping provides option -i. For example to increase ping interval to ten seconds, enter ping -i 10 192.168.0.

In a system with multiple network devices, it is sometimes useful to send the ping through a specific interface address. To do so, use the -I option with the name of the selected device, for example, ping -I wlan1 192.168.0.

For more options and information about using ping, enter ping -h or see the ping (8) man page.

30.7.2.3. Configuring the Network with ifconfig

ifconfig is a traditional network configuration tool. In contrast to ip, you can use it only for interface configuration. If you want to configure routing, use route.

[Note]ifconfig and ip

The program ifconfig is obsolete. Use ip instead.

Without arguments, ifconfig displays the status of the currently active interfaces. As you can see in Example 30.11, “Output of the ifconfig Command”, ifconfig has very well-arranged and detailed output. The output also contains information about the MAC address of your device, the value of HWaddr, in the first line.

Example 30.11. Output of the ifconfig Command

eth0      Link encap:Ethernet  HWaddr 00:08:74:98:ED:51
          inet6 addr: fe80::208:74ff:fe98:ed51/64 Scope:Link
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:634735 errors:0 dropped:0 overruns:4 frame:0
          TX packets:154779 errors:0 dropped:0 overruns:0 carrier:1
          collisions:0 txqueuelen:1000
          RX bytes:162531992 (155.0 Mb)  TX bytes:49575995 (47.2 Mb)
          Interrupt:11 Base address:0xec80
      
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:8559 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8559 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:533234 (520.7 Kb)  TX bytes:533234 (520.7 Kb)    
      
wlan1     Link encap:Ethernet  HWaddr 00:0E:2E:52:3B:1D
          inet addr:192.168.2.4  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fe80::20e:2eff:fe52:3b1d/64 Scope:Link
          UP BROADCAST NOTRAILERS RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:50828 errors:0 dropped:0 overruns:0 frame:0
          TX packets:43770 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:45978185 (43.8 Mb)  TX bytes:7526693 (7.1 Mb)

For more options and information about using ifconfig, enter ifconfig -h or see the ifconfig (8) man page.

30.7.2.4. Configuring Routing with route

route is a program for manipulating the IP routing table. You can use it to view your routing configuration and add or remove of routes.

[Note]route and ip

The program route is obsolete. Use ip instead.

route is especially useful if you need quick and comprehensible information about your routing configuration to determine problems with routing. To view your current routing configuration, enter route -n as root.

Example 30.12. Output of the route -n Command


route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.20.0.0       *               255.255.248.0   U         0 0          0 eth0
link-local      *               255.255.0.0     U         0 0          0 eth0
loopback        *               255.0.0.0       U         0 0          0 lo
default         styx.exam.com   0.0.0.0         UG        0 0          0 eth0

For more options and information about using route, enter route -h or see the route (8) man page.

30.7.3. Start-Up Scripts

Apart from the configuration files described above, there are also various scripts that load the network programs while the machine is booting. These are started as soon as the system is switched to one of the multiuser runlevels. Some of these scripts are described in Table 30.9, “Some Start-Up Scripts for Network Programs”.

Table 30.9. Some Start-Up Scripts for Network Programs

/etc/init.d/network

This script handles the configuration of the network interfaces. The hardware must already have been initialized by /etc/init.d/coldplug (via hotplug). If the network service was not started, no network interfaces are implemented when they are inserted via hotplug.

/etc/init.d/inetd

Starts xinetd. xinetd can be used to make server services available on the system. For example, it can start vsftpd whenever an FTP connection is initiated.

/etc/init.d/portmap

Starts the portmapper needed for the RPC server, such as an NFS server.

/etc/init.d/nfsserver

Starts the NFS server.

/etc/init.d/postfix

Controls the postfix process.

/etc/init.d/ypserv

Starts the NIS server.

/etc/init.d/ypbind

Starts the NIS client.


30.8. smpppd as Dial-up Assistant

Some home users do not have a dedicated line connecting them to the Internet. Instead, they use dial-up connections. Depending on the dial-up method (ISDN or DSL), the connection is controlled by ipppd or pppd. Basically, all that needs to be done to go online is to start these programs correctly.

If you have a flat-rate connection that does not generate any additional costs for the dial-up connection, simply start the respective daemon. Control the dial-up connection with a KDE applet or a command-line interface. If the Internet gateway is not the host you are using, you might want to control the dial-up connection by way of a network host.

This is where smpppd is involved. It provides a uniform interface for auxiliary programs and acts in two directions. First, it programs the required pppd or ipppd and controls its dial-up properties. Second, it makes various providers available to the user programs and transmits information about the current status of the connection. As smpppd can also be controlled by way of the network, it is suitable for controlling dial-up connections to the Internet from a workstation in a private subnetwork.

30.8.1. Configuring smpppd

The connections provided by smpppd are automatically configured by YaST. The actual dial-up programs KInternet and cinternet are also preconfigured. Manual settings are only required to configure additional features of smpppd, such as remote control.

The configuration file of smpppd is /etc/smpppd.conf. By default, it does not enable remote control. The most important options of this configuration file are:

open-inet-socket = yes|no

To control smpppd via the network, this option must be set to yes. The port on which smpppd listens is 3185. If this parameter is set to yes, the parameters bind-address, host-range, and password should also be set accordingly.

bind-address = ip address

If a host has several IP addresses, use this parameter to determine at which IP address smpppd should accept connections. The default is to listen at all addresses.

host-range = min ip max ip

The parameter host-range defines a network range. Hosts whose IP addresses are within this range are granted access to smpppd. All hosts not within this range are denied access.

password = password

By assigning a password, limit the clients to authorized hosts. As this is a plain-text password, you should not overrate the security it provides. If no password is assigned, all clients are permitted to access smpppd.

slp-register = yes|no

With this parameter, the smpppd service can be announced in the network via SLP.

More information about smpppd is available in the smpppd(8) and smpppd.conf(5) man pages.

30.8.2.  Configuring KInternet, cinternet, and qinternet for Remote Use

KInternet, cinternet, and qinternet can be used to control a local or remote smpppd. cinternet is the command-line counterpart of the graphical KInternet. qinternet is basically the same as KInternet, but does not use the KDE libraries, so it can be used without KDE and must be installed separately. To prepare these utilities for use with a remote smpppd, edit the configuration file /etc/smpppd-c.conf manually or using KInternet. This file only uses three options:

sites = list of sites

Here, tell the front-ends where to search for smpppd. The front-ends test the options in the order specified here. The local option orders the establishment of a connection to the local smpppd. gateway points to an smpppd on the gateway. The connection should be established as specified under server in config-file. slp orders the front-ends to connect to an smpppd found via SLP.

server = server

Here, specify the host on which smpppd runs.

password = password

Insert the password selected for smpppd.

If smpppd is active, you can now try to access it, for example, with cinternet --verbose --interface-list. If you experience difficulties at this point, refer to the smpppd-c.conf(5) and cinternet(8) man pages.