% Syncronized to German version: NOT IN SYNC

\chapter{Introduction}

FLI4L is a Linux-based ISDN-, DSL- and Ethernet router, which only 
needs ONE floppy disk to work. Sufficient hardware would be a 486 
PC with 16 MB of RAM.

The boot disk, which is essential for FLI4L, may be generated under 
Unix, Linux or Windows. You will not need any knowledge of Linux 
itself to do so - but it's no fault to have any knowledge about Linux
or Unix. Base knowledge about networking, TCP/IP, DNS and routing 
should be available. If you want to enlarge the functionality of 
FLI4L with your own development, you will need a working Linux system
and additionally knowledge about/of Unix/Linux. 

Since version 2.0 FLI4L ``officially'' supports other boot media than 
floppy disks. Now it's possible to install more software packages on
the FLI4L router; more than there would have been if only a floppy 
disk had been used.
Before you begin to create a FLI4L installation for hard disk or compact
flash media, you should already have successfully installed a ``standard''
floppy disk configuration as a base installation.
Most optional software packages (OPT packages) may already be available 
if only a floppy disk installation had been created. Therefore it may 
only be necessary to use a hard disk if you want to install the whole 
variety of software available for FLI4L.

Features:

\begin{itemize}
\item Creation of a boot floppy disk under Linux, Unix and Windows
\item Configuration by using plain ASCII textfiles
\item Support for IP masquerading and port forwarding
\item Least-Cost-Routing: automatical selection of provider - depending on 
  (day) time
\item Display/calculation/protocol of connect times and costs
\item Windows/Unix/Linux client imonc incl. interface to imond and telmond
\item Upload of new configuration data/files via Windows client imonc
\item Boot floppy disk with vfat file system for permanent storage of files
\item Support for 1680kB floppy disks
\item Packet filter: Logging of remote access to restricted/denied ports
\item Consistent implementation of WAN interfaces via (so called) circuits
\item Operation/Routing of ISDN and DSL circuits is possible in parallel
\end{itemize}

Router:

\begin{itemize}
\item Linux-Kernel 2.4.26
\item Packet filter and IP masquerading
\item DNS server to avoid every request of Windows PCs being sent to the 
  internet
\item Networking capability for imond server with monitor and LCR control 
  function
\item Networking capability for telmond server so you will be notified of
  incoming telephone calls
\end{itemize}

Ethernet-Support:

\begin{itemize}
\item Up-to-date network adapter drivers: Support for more than 40 adapter
  families
\end{itemize}

DSL-Support:

\begin{itemize}
\item Roaring Penguin PPPoE driver; with Dial-on-Demand (de-selectable)
\item PPTP for DSL connections in Austria and the Netherlands (EXPERIMENTAL)
\end{itemize}

ISDN:
 
\begin{itemize}
\item Up-to-date HiSaX drivers: Support for 37 ISDN adapter types
\item Several ISDN connection variants: in/out/callback, raw-ip/ppp 
\item Channel bundling: automatic bandwidth adaption or manual
\item optional IPX routing
\end{itemize}

Optional program packages:

\begin{itemize}
\item DNS server
\item DHCP server
\item SSH login
\item Telnet and/or FTP service
\item Simple online/offline Display via LED
\item LCD display program with changeable output format
\item Serial console as option (see HOWTO on
  \link{http://3})
\item Mini webserver for monitoring
\item IPSEC modules ipsec and pptp
\item Restricted access for specific remote networks
\item PCMCIA support (EXPERIMENTAL)
\item Protocol of system messages: syslogd und klogd
\item Configuration of ISA-PNP-adapters: isapnp tools
\item Additional tools for debugging
\item Configuration of serial port
\item Emergency system for remote maintance via ISDN
\item LCD display as monitor: Display for connections and connection data
\item PPP server/router via serial port
\item ISDN modem emulator via serial port
\item print server
\item Access to time server for synchronisation of time in the network
\item Execution of commands/procedures when a telephone call occurs (ex.: 
  internet dial-in)
\item Support for IP aliasing (more than one IP address on one network
  adapter)
\end{itemize}

Hardware requirements:

\begin{itemize}
\item ISDN: '386 CPU from 25 MHz, recomm.: '486 from 33 MHz
\item DSL: '486 CPU from DX2/66, recomm.: '486 DX4/100 or Pentium from 75 MHz
\item 8 MB memory, recomm. 16 MB
\item Ethernet network adapter (support for more than 40 different adapter
  families)
\item ISDN: ISDN adapter supported by HiSax (type 1-37), AVM-B1 ISA/PCI
\item No drives, except floppy disk drive
\item 1 boot floppy disk; with all necessary files and data on it
\item optional IDE hard disk drive or Compact-Flash medium
  (that can be adressed like a hard disk)
\end{itemize}

For control/status display of the FLI4L router there is another tool
available:
the client imonc. This program is available fo Windows (windows/imonc.exe)
and also for Linux (unix/gtk-imonc).

And now\ldots \\

Have lots of fun with fli4l!\\[1.5ex]

Frank Meyer, \email{frank@fli4l.de}

\chapter{Installation}


Under Linux:
 
\begin{verse}{\tt tar xvfz fli4l-\version.tar.gz}\end{verse}

Under Unix:

\begin{verse}{\tt gtar xvfz fli4l-\version.tar.gz}\end{verse}

If gtar is not existent at all, you may use the following code:

\begin{verse}{\tt gzip -d < fli4l-\version.tar.gz | tar xvf -}\end{verse}

Those, who want to do the installation in an existing FLI4L directory,
should call the script mkclean.sh afterwards: 

\begin{verse}{\tt
    cd fli4l-\version\\
    sh mkclean.sh
}\end{verse}

In the Windows environment the zipped tar archive may be extracted by 
using WinZIP. Please make sure that files \emph{and} directories (check
settings in WinZIP!) are extracted. Additionally, you will have 
to switch off the so called ``Smart TAR cr conversion'' in
\emph{Options \pfeil Configuration}. If this option is switched on,
some of the files (that are important) will not be extracted correctly.

Alternatively you may use the program Powerarchiver 
(\link{http://www.powerarchiver.com}), which is just as good as WinZip.

Follwing files will be installed in sub-directory {\tt fli4l-\version/}:

\begin{itemize}
\item Documentation:
  \begin{itemize}
  \item doc/deutsch/* German documentation
  \item doc/english/* English documentation
  \end{itemize}
  
\item Configuration:
  \begin{itemize}
  \item config/*.txt Configuration files - you have to edit those!
  \end{itemize}

\item Scripts/Procedures:
  \begin{itemize}
  \item mkclean.sh Clean up: Linux/Unix-Version
  \item mkclean.bat Clean up: Windows-Version
  \item mkfloppy.sh Create boot disk: Linux/Unix-Version
  \item mkfloppy.bat Create boot disk: Windows-Version
  \end{itemize}
  
\item Kernel/Root filesystems:
  \begin{itemize}
  \item img/kernel Linux mini kernel 2.4.26
  \item img/rootfs.gz Compressed minix file system as image
  \end{itemize}
  
\item Driver modules:
  \begin{itemize}
  \item opt/* Description file opt.tgz and optional kernel modules, files and
    programs
  \end{itemize}
  
\item Source:
  \begin{itemize}
  \item src/* Sources/tools for Linux, see: src/README
  \end{itemize}
  
\item Programs:
  \begin{itemize}
  \item unix/mkfli4l* Creation of boot disk: Unix/Linux version
  \item windows/* Creation of boot disk: Windows version
  \item unix/imonc* imond client for Unix/Linux
  \item windows/imonc.exe imond client for Windows
  \end{itemize}
\end{itemize}

Configuring fli4l is done by editing the *.txt files in the config/ folder.
After this you may generate the boot disk by issuing one single command. 

\achtung {Never use old config files from an earlier version of fli4l as
  template. They are not compatible!}


\section{Variants}

In earlier versions of fli4l the only supported boot option was using a
floppy disk. If you only use fli4l as a router, this is all you will need.

Because of lot of possible (but not always necessary!) software packages for
fli4l since version 2.0 you can also install fli4l on hard disk or compact
flash modules.

You should, however, always try installing fli4l using the one-disk-variant
and that way gain experience in using the software. Of course the capacity
of a floppy disk is very limited. If you want to use fli4l as an answering
machine and HTTP proxy, you will soon run out of space on a single floppy
disk.
For such extensions, installation on hard disk or compact flash module may be
used. It is a bit more complicated than it is with the floppy disk.
Therefore you should only try it if you already have experience in using
fli4l.
Once more: fli4l as a router only, needs one floppy disk - no need to use a
hard disk!


There are four variants installing fli4l:

\begin{description}
\item Router on single floppy disk -- traditional installation
\item[Type A] Router on hard disk -- only one fat partition
\item[Type B] Router on hard disk -- one fat and one minix partition
\item[Type C] Router on hard disk, partitions are manually created
\end{description}


\marklabel{INSTALLTYP0}{\subsection{Router on a single floppy disk --
    traditional installation}}

All necessary files are stored on a DOS-formatted floppy disk. The rootfs
will be uncompressed to a 1.4 MB RAM disk, files originating from the archive
opt.tgz are copied to a second RAM disk with variable size (min. 1 MB). In
this minimal configuration the operation of a router is possible with 8 MB
RAM. The maximum configuration is only limited by the capacity of the floppy
disk and the size of the memory used in the computer.


\marklabel{INSTALLTYPA}{\subsection{Type A: Router on hard disk -- only one
    fat partition}}

This is the same as the floppy disk version, except the files are stored on
a hard disk.
When we use the term ``Hard disk'' here, it also means compact flash media
and other devices, that can be addressed as IDE hard disk from Linux.

A SCSI hard disk, a ZIP drive or a LS120 drive cannot be used (not yet),
because these devices need different drivers in the kernel. The size of the
archive opt.tgz is no longer limited to the capacity of the floppy disk, but
all files in the archive are extracted to a RAM disk during boot. So the RAM
disk of course has to be large enough. This increases RAM usage when using 
a lot of packages. 

For an update of the software packages (i.e.: updating opt.tgz via network) 
the FAT partition must be large enough to hold the kernel, the rootfs and
TWICE the archive opt.tgz!
If you also want to use the emergency option, you will need space for another
copy of opt.tgz.


\marklabel{INSTALLTYPB}{\subsection{Type B: Router on hard disk -- one fat
    and one minix partition}}

Contrary to type A, this one doesn't use a second RAM disk. Files contained
in the archive opt.tgz will be copied directly to a minix partition when the
router boots. When the files are needed, they will be loaded from that
location later on.
This version needs least space on a RAM disk and the number of packages in
the archive opt.tgz is (almost) only limited to hard disk size.


\marklabel{INSTALLTYPC}{\subsection{Type C: Router on hard disk,
    partitions are manually created}}

Using this variant, the setup script will not re-partition your hard disk.
Instead, you will have to create, format and mark as bootable at least one
FAT partition before running the setup script.

The setup script will ask you for a name to assign this partition afterwards.
Additionally you may create and format swap and data partitions.
Extended partitions are also possible in this variant.

Note that you must not use FAT32 file system for the boot partition! The 
syslinux boot program can only load the Linux kernel from a DOS partition. So
FAT16 file system is mandatory!

Additionally you will have to set the correct parameters when creating the 
file system. The FAT partition may also be formatted using a simple DOS
floppy disk.

This installation variant is meant for users with linux-expirience. Therefore
we will not provide a detailed description of the program fdisk here.

Additional information on installation on hard disk drives can be found in
the documentation of the package HD, that can be downloaded seperately - the
first variable described is \var{OPT\_\-HDINSTALL}.


\chapter{Basic configuration}


Since version 2.0 the fli4l distribution is modular and divided in multiple
packages. Those have to be downloaded seperately. The package
{\tt fli4l-\version.tar.gz} only contains the basic software for an ethernet
router. If you want to use DSL, ISDN or other software you have to download
the corresponding packages separately. They then have to be extracted
starting from the directory {\tt fli4l-\version/}(!). See the table
\smalljump{tab:zusatzpakete} for a quick overview of the available packages.

\begin{table}[htbp]
  \begin{center}
    \begin{tabular}{ll}

      Download archive & Package \\
      \hline
      {\tt fli4l-\version}            &    BASIS, required!\\
      \verb*zdslz                     &    DSL router (PPPoE, PPTP)\\
      \verb*zisdnz                    &    ISDN router\\
      \verb*zdhcpz                    &    DHCP server\\
      \verb*zhdz                      &    Installation on hard disk\\
      \verb*zhttpdz                   &    Mini-Webserver for status information\\
      \verb*zinetz                    &    Telnet/FTP/SSH server\\
      \verb*zipxz                     &    IPX over ISDN\\
      \verb*zlcdz                     &    LCD driver software + status display\\
      \verb*zlpdsrvz                  &    Print server (no spooling)\\
      \verb*zpcmciaz                  &    Support for PCMCIA-Cards\\
      \verb*zpppz                     &    PPP-connectivity using serial interface\\
      \verb*zproxyz                   &    HTTP-proxy\\
      \verb*zserialz                  &    Tools for serial interface\\
      \verb*ztimez                    &    Time server/client\\
      \verb*ztoolsz                   &    Various linux programs as tools\\
      
    \end{tabular}
    
    \caption{Overview of additional packages}
    \marklabel{tab:zusatzpakete}{}
  \end{center}
\end{table}

The files used for configuring the fli4l router reside in the directory
config/ and will be described below.

These files may be edited using a text editor or the Windows configuration
software. With the aid of the ``fli4l wizard'' the necessary settings can be
customized by just clicking some buttons... This program was created by
Carsten Cerny and Jürgen Bauer. It aims at enabling the user to generate a
standard router configuration without much knowledge about networks.
Since fliwiz also generates ASCII files itself that can be used as
configuration files, the user may decide what solution he prefers - the
fliwiz or just a text editor.

If you have ideas on how to enhance the program, Carsten 
(\email{carsten.cerny@cc13.com}) or Jürgen (\email{jb@idowa.de}) will be
pleased to hear from you.
The current version of fliwiz can be found -- just like fli4l -- on
\link{http://www.fli4l.de/}.

If you want to change settings other than those described below, you will
need a linux installation in order to edit the rootfs. In this case you
should have a look at src/README.



\index{base.txt}
\index{Example for file base.txt}
\marklabel{beispielbase}{\section{Example file}}

The example for the file ``base.txt'' in the directory ``config'' contains
the following:

\begin{scriptsize}
\begin{example}
\begin{verbatim}
#------------------------------------------------------------------------------
# General settings:
#------------------------------------------------------------------------------
HOSTNAME='fli4l'                # name of fli4l router
PASSWORD='fli4l'                # password for telnetd, ftpd and sshd
FDD_1680='no'                   # use 1680KB-Floppy
MOUNT_BOOT='rw'                 # mount boot device (floppy): ro, rw, no

PART_OPT='auto'                 # disk-partition or size of ramdisk or `auto'
MOUNT_OPT='ro'                  # mount opt device: ro, rw
UPDATE_MODE='full'              # add, cfg, full, none, see documentation
TIME_INFO='MEZ-1MESZ,M3.5.0,M10.5.0' 
                                # description of local time
                                # zone, don't touch without reading
                                # documentation

#------------------------------------------------------------------------------
# Serial console:
#------------------------------------------------------------------------------
SER_CONSOLE='no'                # use serial interface instead of crt/keyboard
SER_CONSOLE_IF='0'              # serial interface to use, e.g. 0 
                                # for the use of ttyS0 (COM1)
SER_CONSOLE_RATE='9600'         # Baudrate for serial console

#------------------------------------------------------------------------------
# Ethernet card drivers:
# uncomment your ethernet card
#------------------------------------------------------------------------------
NET_DRV_N='1'                   # number of ethernet drivers to load, usually 1
#NET_DRV_1='3c505'              # ISA: 3COM Etherlink Plus (3c505)
#NET_DRV_1='3c507'              # ISA: 3COM Etherlink 16 (3c507)
#NET_DRV_1='3c509'              # ISA: 3COM EtherLinkIII (3c509)
#NET_DRV_1='3c515'              # ISA: 3COM EtherLink XL ISA (3c515)
#NET_DRV_1='3c59x'              # PCI: 3COM Vortex/Boomerang 3c59x,3c900,3c905
#NET_DRV_1='82596'              # Apricot Xen-II on board Ethernet
#NET_DRV_1='3c503'              # ISA: 3COM EtherLinkII (3c503)
#NET_DRV_1='e2100'              # ISA: Cabletron E21xx ISA
#NET_DRV_1='hp'                 # ISA: HP PCLAN (27245, 27xxx) ISA
#NET_DRV_1='hp-plus'            # ISA: HP PCLAN+ (27247B and 27252A) ISA
NET_DRV_1='ne'                  # ISA: NE2000 ISA clone (eg. Realtek 8019,
                                # Accton 16xx, NatSemi 8390, UMC 9003/9008)
#NET_DRV_1='ne2k-pci'           # PCI: NE2000 PCI clone (eg. Realtek 8029,
                                # Winbond 89c940)
#NET_DRV_1='smc-ultra'          # ISA: SMC ULTRA
#NET_DRV_1='smc-ultra32'        # EISA: SMC ULTRA32 (NEW)
#NET_DRV_1='wd'                 # ISA: SMC WD80*3
#NET_DRV_1='at1700'             # ISA: AT1700 (Fujitsu 86965) ISA
#NET_DRV_1='cs89x0'             # ISA: IBM Etherjet, cs89x0 based Cards
                                # (Option io=0xnnn necessary!)
#NET_DRV_1='de4x5'              # PCI/EISA: Digital DE425, DE434, DE435, DE450, DE500
#NET_DRV_1='depca'              # ISA: DEPCA, DE10x, DE200, DE201, DE202, DE422
#NET_DRV_1='dgrs'               # PCI: Digi International RightSwitch PCI/EISA
#NET_DRV_1='dmfe'               # PCI: DM9102 compatible PCI cards from Davicom
#NET_DRV_1='elp486'             # ISA: Intel Professional Workstation/panther 82596
#NET_DRV_1='eepro'              # ISA: Intel EtherExpress Pro/10
#NET_DRV_1='eepro100'           # PCI: Intel EtherExpressPro PCI 10+/100B/100+
#NET_DRV_1='eexpress'           # ISA: EtherExpress16 ISA
#NET_DRV_1='epic100'            # PCI: SMC EPIC/100 (EtherPower II) PCI
#NET_DRV_1='eth16i'             # ISA/EISA: ICL EtherTeam 16i/32
#NET_DRV_1='ewrk3'              # ISA: EtherWORKS 3 ISA (DE203, DE204, DE205)
#NET_DRV_1='fealnx'             # PCI: ASOUND LAN 8139 card - not RTL8139 (NEW)
#NET_DRV_1='hp100'              # ISA/EISA/PCI: HP 10/100VG PCLAN (ISA, EISA, PCI)
#NET_DRV_1='lance'              # ISA: AMD LANCE and PCnet (AT1500, NE2100) ISA
#NET_DRV_1='old_tulip'         # PCI: Old DECchip Tulip (dc21x4x) PCI
#NET_DRV_1='pcnet32'            # PCI: AMD PCI PCnet32
#NET_DRV_1='rtl8139'            # PCI: RealTek 8129/8139 (not 8019/8029!) (NEW)
#NET_DRV_1='8139too'            # PCI: RealTek 8139 10/100 MB (NEW)
#NET_DRV_1='sis900'             # PCI: SiS 900/7016
#NET_DRV_1='sundance'           # PCI: DFE-550FX or DFE-530TXS (NEW)
#NET_DRV_1='tlan'               # PCI: TI ThunderLAN (Compaq Netelligent)
#NET_DRV_1='tulip'              # PCI: DECchip Tulip (dc21x4x) PCI
#NET_DRV_1='natsemi'            # PCI: Nat Semi
#NET_DRV_1='starfire'           # PCI: Starfire
#NET_DRV_1='via-rhine'          # PCI: VIA Rhine PCI (3043, VT86c100A, dfe-530tx)
#NET_DRV_1='winbond-840'        # PCI: Winbond 840
#NET_DRV_1='lanstreamer'        # Token Ring: IBM Auto LANStreamer PCI Adapter
#NET_DRV_1='olympi'             # Token Ring: IBM cards (Pit/Pit-Phy/Olympic)
#NET_DRV_1='ibmtr'              # Token Ring: IBM 16/4
#NET_DRV_1='pcnet_cs'          # PCMCIA: NS8390-based cards (NE2000, DLINK etc)
#NET_DRV_1='3c574_cs'          # PCMCIA: 3Com 574
#NET_DRV_1='3c575_cb'          # PCMCIA: 3Com 575
#NET_DRV_1='3c589_cs'          # PCMCIA: 3Com 589
#NET_DRV_1='airo'               # PCMCIA: Airo 4500 \& 4800 series cards
#NET_DRV_1='airo_cs'           # PCMCIA: Airo 4500 \& 4800 series cards
#NET_DRV_1='eepro100_cb'       # PCMCIA: EtherExpress Pro 100
#NET_DRV_1='epic_cb'           # PCMCIA: SMC 83c170 EPIC/100
#NET_DRV_1='ibmtr_cs'          # PCMCIA: IBM Token Ring
#NET_DRV_1='netwave_cs'        # PCMCIA: Netwave AirSurfer Wireless LAN
#NET_DRV_1='nmclan_cs'         # PCMCIA: New Media Ethernet LAN
#NET_DRV_1='pcnet_cs'          # PCMCIA: NS8390 Based cards
#NET_DRV_1='ray_cs'            # PCMCIA: Raylink wireless cards
#NET_DRV_1='smc91c92_cs'       # PCMCIA: SMC91c92-based cards
#NET_DRV_1='tulip_cb'          # PCMCIA: DEC 21040-family cards
#NET_DRV_1='wavelan_cs'        # PCMCIA: WaveLAN
#NET_DRV_1='wavelan2_cs'       # PCMCIA: WaveLAN2
#NET_DRV_1='wvlan_cs'          # PCMCIA: Lucent WaveLAN/IEEE 802.11
#NET_DRV_1='xirc2ps_cs'        # PCMCIA: Xircom: CE2, CEM28, CEM33, or CE3
#NET_DRV_1='wl24_cs'           # PCMCIA: ELSA Airlancer MC-2
#NET_DRV_1='cs89x0_cs'         # PCMCIA: IBM EtherJet Ethernet Adapter

NET_DRV_1_OPTION=''             # additional option, e.g. `io=0x340' for ne

#------------------------------------------------------------------------------
# Ether networks used with IP protocol:
#------------------------------------------------------------------------------
IP_NET_N='1'                        # number of ip ethernet networks, usually 1
IP_NET_1='192.168.6.1/24'           # IP address and netmask of your n'th ethernet card
IP_NET_1_DEV='eth0'                 # required: other device name than ethX

#------------------------------------------------------------------------------
# Additional routes, optional
#------------------------------------------------------------------------------
IP_DEFAULT_GATEWAY=''               # normally not used, read documentation!
IP_ROUTE_N='0'                      # number of additional routes
IP_ROUTE_1='192.168.7.0 255.255.255.0 192.168.6.99' # network netmask gateway

#------------------------------------------------------------------------------
# Masquerading:
#------------------------------------------------------------------------------
MASQ_NETWORK='192.168.6.0/24'       # networks to masquerade (e.g. our LAN)
MASQ_MODULE_N='1'                   # load n masq modules (default: only ftp)
MASQ_MODULE_1='ftp'                 # ftp
MASQ_MODULE_1_OPTION=''             # options, see docs
MASQ_MODULE_2='irc'                 # irc
MASQ_MODULE_2_OPTION=''             # options, see docs

#------------------------------------------------------------------------------
# Optional package: PORTFW
#------------------------------------------------------------------------------
OPT_PORTFW='no'                     # install port forwarding tools/modules
PORTFW_N='1'                        # how many portforwardings to set up
PORTFW_1_SOURCE='8080'              # sample 1: forward ext. port 8080
PORTFW_1_TARGET='192.168.6.15:80'   # \ldots to int. host 192.168.6.15 port 80
PORTFW_1_PROTOCOL='tcp'             # \ldots using tcp
PORTFW_2_SOURCE='3000-3010'         # sample 2: forward portrange 3000-3010
PORTFW_2_TARGET='192.168.6.15'      # \ldots to int. host 192.168.6.15
PORTFW_2_PROTOCOL='tcp'             # \ldots using tcp

#------------------------------------------------------------------------------
# Routing without masquerading
#------------------------------------------------------------------------------
ROUTE_NETWORK=''                    # optional: route from/to network, no masq

#------------------------------------------------------------------------------
# Routing: internal hosts to allow/deny forwarding
#
# FORWARD_HOST_WHITE='no' describes a black list (forbidden)
# FORWARD_HOST_WHITE='yes' describes a white list (allowed)
#
# Example:
#   FORWARD_HOST_WHITE='no' and FORWARD_HOST_N='0':
#    -> forwarding of 0 hosts is denied
#    -> forwarding of all hosts is allowed.
#------------------------------------------------------------------------------
FORWARD_HOST_WHITE='no'              # 'no': black list, 'yes': white list
FORWARD_HOST_N='0'                   # number of allowed/denied hosts
FORWARD_HOST_1='192.168.6.5'         # optional: 1st allowed/denied host
FORWARD_HOST_2='192.168.6.6'         # optional: 2nd allowed/denied host

#------------------------------------------------------------------------------
# Routing: ports to reject/deny forwarding (from inside and outside!)
#------------------------------------------------------------------------------
FORWARD_DENY_PORT_N='1'              # no. of ports to reject/deny forwarding
FORWARD_DENY_PORT_1='137:139 REJECT' # deny/reject forwarding of netbios
TRUSTED_NETS=''                      # but optionally allow forwarding between LANs

#------------------------------------------------------------------------------
# Filter: accept connections from outside to several ports (served ports)
#------------------------------------------------------------------------------
INPUT_POLICY='reject'               # policy for input chain: reject or drop
INPUT_ACCEPT_PORT_N='0'             # no. of ports to accept from outside
INPUT_ACCEPT_PORT_1='22 TCP'        # e.g. allow connection to ssh service

DENY_ICMP='no'                      # deny icmp (ping): yes or no
PACKETFILTER_LOG='no'               # log access to rejected/denied ports

#------------------------------------------------------------------------------
# Domain configuration:
#------------------------------------------------------------------------------
OPT_DNS='yes'                       # start dns server: yes or no
DNS_FORWARDERS='192.76.144.66'      # DNS servers of your provider, e.g. MSN
DNS_VERBOSE='no'                    # log queries in /usr/local/ens/ens.log
DOMAIN_NAME='lan.fli4l'             # your domain name
DNS_FORBIDDEN_N='0'                 # number of forbidden domains
DNS_FORBIDDEN_1='foo.bar'           # 1st forbidden domain
DNS_FORBIDDEN_2='bar.foo'           # 2nd forbidden domain
HOSTS_N='4'                         # number of hosts in your domain
HOST_1_NAME='fli4l'                 # 1st host: ip and name
HOST_1_IP='192.168.6.1'
#HOST_1_ALIAS_N='0'                 # number of optional alias names
#HOST_1_ALIAS_1='router.lan.fli4l'  # optional alias name
#HOST_1_ALIAS_2='gateway.lan.fli4l' # optional alias name
HOST_2_NAME='client2'               # 2st host: ip and name
HOST_2_IP='192.168.6.2' 
#HOST_2_MAC='de:ad:af:fe:07:19'     # optional mac address used by dhcpd
HOST_3_NAME='client3'               # 3st host: ip and name
HOST_3_IP='192.168.6.3' 
#HOST_3_MAC='de:ad:be:ef:07:19'     # optional mac address used by dhcpd
HOST_4_NAME='client4'               # 4st host: ip and name
HOST_4_IP='192.168.6.4' 
#HOST_4_MAC='de:ad:be:ef:08:15'     # optional mac address used by dhcpd
MX_N='0'                            # optional number of MX-records
MX_1_DOMAIN='example.net'           # domain handled by the following mail exchanger
MX_1_SERVER='mail.example.net'      # fqdn of the mx
MX_1_PRIORITY='10'                  # priority of the mx, lower means better

# Special DNS configuration
#------------------------------------------------------------------------------
DNS_SPECIAL_N='0'                           # number of special dns servers, normally 0
#DNS_SPECIAL_1='firma.de 192.168.1.12'      # 1st special dns server for firma.de
#DNS_SPECIAL_2='lan.firma.de 192.168.2.12'  # 2nd special dns server for lan.firma.de

#------------------------------------------------------------------------------
# imond configuration:
#------------------------------------------------------------------------------
START_IMOND='no'                    # start imond: yes or no
IMOND_PORT='5000'                   # TCP-Port, see also \var{FIREWALL\_\-DENY\_\-PORT\_\-x}!
IMOND_PASS=''                       # imond-password, may be empty
IMOND_ADMIN_PASS=''                 # imond-admin-password, may be empty
IMOND_LED=''                        # tty for led: com1 - com4 or empty
IMOND_BEEP='no'                     # beep if connection going up/down
IMOND_LOG='no'                      # log /var/log/imond.log: yes or no
IMOND_LOGDIR='/var/log'             # log-directory, e.g. /var/log
IMOND_ENABLE='yes'                  # accept ``enable/disable'' commands
IMOND_DIAL='yes'                    # accept ``dial/hangup'' commands
IMOND_ROUTE='yes'                   # accept ``route'' command
IMOND_REBOOT='yes'                  # accept ``reboot'' command

#------------------------------------------------------------------------------
# Generic circuit configuration:
#------------------------------------------------------------------------------
IP_DYN_ADDR='yes'                   # use dyn. ip addresses (most providers do)
DIALMODE='auto'                     # standard dialmode: auto, manual, or off

#------------------------------------------------------------------------------
# optional package: syslogd
#------------------------------------------------------------------------------
OPT_SYSLOGD='no'                    # start syslogd: yes or no
SYSLOGD_DEST_N='1'                  # number of destinations
SYSLOGD_DEST_1='*.* /dev/console'   # n'th prio \& destination of syslog msgs
SYSLOGD_DEST_2='*.* @192.168.6.2'   # example: loghost 192.168.6.2
SYSLOGD_DEST_3='kern.info /var/log/dial.log'    # example: log infos

#------------------------------------------------------------------------------
# optional package: klogd
#------------------------------------------------------------------------------
OPT_KLOGD='no'                      # start klogd: yes or no

#------------------------------------------------------------------------------
# optional package: y2k correction
#------------------------------------------------------------------------------
OPT_Y2K='no'                        # y2k correction: yes or no
Y2K_DAYS=''                         # correct hardware Y2K-Bug: add x days

#------------------------------------------------------------------------------
# Optional package: PNP
#------------------------------------------------------------------------------
OPT_PNP='no'                        # install isapnp tools: yes or no
\end{verbatim}
\end{example}
\end{scriptsize}


Note: This file is stored in DOS format. That means, at the end of every
line, there is an additional carriage return (CR). Since most UNIX editors
will not encounter any problems with this format, I decided to use it.
Windows Notepad, on the other hand, cannot handle file without these CRs!

If there are, contrary to expectations, any problems with your favourite
Unix/Linux editors, you may use the following command before editing to
convert it to Unix format: 

\begin{example}
\begin{verbatim}
        sh unix/dtou config/base.txt
\end{verbatim}
\end{example}

When you create a boot floppy disk it is not important, if the file contains
any CRs at ends of lines or not. All CRs, as well as the comments after '\#',
will be completely ignored when the file is written to the disk. 

So let's get started now!


\section{General Settings}

\begin{description}

  \config{HOSTNAME}{HOSTNAME}{HOSTNAME}
  
  {First of all you should name your FLI4L router. In this example it is:
    ``fli4l''. This name should appear again in the domain configuration: 
    \var{HOST\_\-x} (see below).}

  \config{PASSWORD}{PASSWORD}{PASSOWRD}
  
  {If you want to use optional services like telnet, ssh or ftp, you should
    use a good password - even if these services are - because of the
    firewall functionality of fli4l - only reachable from the LAN.

    Since version 1.5 you must define a password.

    See also: \var{OPT\_\-TELNETD}  \var{OPT\_\-FTPD}  \var{OPT\_\-SSHD}

    Default setting: \var{PASSWORD}='fli4l'}

  \config{FDD\_1680}{FDD\_1680}{FDD1680}

  {If you want to use high capacity floppy disks, set this option
    to ``yes''. The parameter ``-h'' when calling ``mkfloppy'' is
    obsolete.}

  \config{MOUNT\_BOOT}{MOUNT\_BOOT}{MOUNTBOOT}
  
  {Here you have to decide how your floppy disk will be ``mounted''. You have
    three choices:

    \begin{description}
    \item[rw] -- Read/Write
    \item[ro] -- Read only
    \item[no] -- None -- Floppy disk will not be accessible after boot.
    \end{description}

    Some configurations need the floppy disk to be mounted read/write; for 
    example if you want to use the DHCP server or you want to create an imond
    log file on the floppy disk. 

        Default setting: \var{MOUNT\_\-BOOT}='rw'}

  \config{PART\_OPT}{PART\_OPT}{PARTOPT}

  {PART\_OPT contains information about the place where opt.tgz should be
    decompressed to. This can be a RAM disk of automatically or manually
    determined size or a already existing and formatted minix partition on a
    hard disk or CF medium.

    Possible values:
    
    \begin{description}
    \item[auto] The space required by the uncompressed files in opt.tgz
      is calculated on boot and a RAM disk of this size is created.
      This is the optimal setting for a floppy router!
      Also, if you installed on hard disk or CF (Type B), opt.tgz is 
      automatically decompressed to the respective medium.
      
    \item[a number between 1000 and 29999] A RAM disk of this size (in kB)
      will be created and opt.tgz will be decompressed to it. This setting
      may be useful, if you want to place logfiles in the RAM disk (If so,
      you'll also have to set \var{MOUNT\_\-OPT}='rw').
      
    \item[a partition descriptor, e.g. hda2] The archive opt.tgz will be
      decompressed to this existing partition. This corresponds to a HD
      installation \jump{INSTALLTYPB}{Type B}.
      Use the following values:
      \begin{description}
      \item[hda2] for a hard disk as master on primary IDE port
      \item[hdb2] for a hard disk as slave on primary IDE port
      \item[hdc2] for a hard disk as master am secundary IDE port
      \item[hdd2] for a hard disk as slave am secundary IDE port
      \end{description}
      In case you decided to manually partition your hard disk, you'll have
      to set this variable to the minix partition you planned to use for this
      purpose.

      Attention: Use only lower case characters!
    \end{description}

    Should you encounter error messages ``try-to-free-pages'' there is not
    enough free usable RAM remaining for running programs. Try the following:

    \begin{itemize}
    \item install more RAM
    \item set \var{PART\_\-OPT} to auto or decrease the number a little
    \item use less OPT packages
    \item install the router following install \jump{INSTALLTYPB}{Type B}
      and then set \var{PART\_\-OPT} to a partition.
    \end{itemize}
    
    Default setting: \var{PART\_\-OPT}='auto'}

  \config{MOUNT\_OPT}{MOUNT\_OPT}{MOUNTOPT}

  {You may select here, if the router should mount the partition,
    which was defined in PART\_OPT, as read-only('ro')  or read/write('rw'). 

    Default setting: \var{MOUNT\_\-OPT}='ro'}

  \config{UPDATE\_MODE}{UPDATE\_MODE}{UPDATEMODE}

  {Here you may select, how un-compressing the opt.tgz to a hard disk will
    be done. 

    Possible choices:
    \begin{description}

    \item[add] opt.tgz will simply be copied to/over the already existing 
      files. Files with identical names will be overwritten. Other files that
      you may have copied manually to the router will not be overwritten (of
      course) and will not be deleted.

    \item[cfg] all configuration files that already exist in the folders etc
      and var will be deleted before uncompressing opt.tgz.

    \item[full] folders etc, var and files (that means: all files included in
      opt.tgz) will be deleted before uncompressing opt.tgz. This is the
      setting which gives you most safety for configuring the router. You
      will always have a ``clean'' and complete configuration on your router.

    \item[none] opt.tgz will not be uncompressed, there will be no automatic
      updates. 

    \end{description}

    Please remeber to use only lower case characters!

    Default setting: \var{UPDATE\_\-MODE}='full'}

  \config{TIME\_INFO}{TIME\_INFO}{TIMEINFO}

  Clocks in a Unix-environment (and thus also on fli4l) normally are set to
  UTC (``Coordinated Universal Time''), a standard time zone, that is being
  converted to local time when needed. \var{TIME\_\-INFO} supplies fli4l with
  the necessary information about the names of the time zones, the difference
  between UTC and local time and when daylight saving time will be activated
  and deactivated. For this to work, the hardware clock has to be set to UTC
  or has to be syncronized with a time server via \var{OPT\_\-TIME}. Those
  are set to UTC.

  A entry in \var{TIME\_\-INFO} has the following meaning:
\begin{example}
\begin{verbatim}
        TIME_INFO='MEZ-1MESZ,M3.5.0,M10.5.0'
\end{verbatim}
\end{example}
  \begin{itemize}
  \item {\em MEZ-1:} We're in a central european timezone ({\em MEZ}, which
    is one hour ahead of the UTC {\em MEZ-1=UTC}.
  \item {\em MESZ:} There is daylight saving time in this time zone
    (Mitteleuropäische Sommerzeit - central european daylight saving time).
    As nothing more is specified, daylight saving time means setting the
    clock one hour ahead.
  \item {\em M3.5.0,M10.5.0':} On the last sunday of march the change to
    daylight saving time is being performed, on the last sunday of october
    it is reversed.
  \end{itemize}

  You won't have to touch this values unless you're residing in a timezone
  other than CET. In that case one should have a look at the definition of
  the environment variable TZ that can be found here:

\link{http://www.opengroup.org/onlinepubs/007904975/basedefs/xbd\_chap08.html}
\end{description}

\section{Serial Console}

\begin{description}
  \config{SER\_CONSOLE}{SER\_CONSOLE}{SERCONSOLE}

    fli4l can be used without any keyboard or graphic adapter. To be able
    to operate the router without telnet or SSH and to be able to review all
    boot-messages, it is possible to redirect in- and output to the serial 
    interface. For this to work, \var{SER\_CONSOLE}='yes' has to be set.
    If \var{SER\_CONSOLE} is set to 'yes', \var{SER\_CONSOLE\_IF} and
    \var{SER\_CONSOLE\_RATE} have to be configured as well.

      Default setting: \var{SER\_CONSOLE}='no'

    mkfli4l generates the configuration file used by the bootloader from a
    template named {\em syslinux.tmpl (img/syslinux.tmpl)}
    \marklabel{SYSLINUXTEMPL}{}.
    Depending on the configuration, several settings are inserted to this
    file. If you want to pass additional boot-parameters to the kernel, they
    can be inserted in the {\em APPEND}-line after the text {\em
    boot=/dev/fd0}. The parameters will be used automatically by the
    bootloader.

    Settings for the serial console can only be changed when installing from
    scratch or if the floppy disk version is used. A remote update that
    replaces rc.cfg and opt.tgz (using imonc/scp/ftp/samba) is not
    sufficient (as syslinux.cfg will not be replaced). Replacing it with
    /img/syslinux.cfg will not work either since fli4l will boot from floppy
    disk then.

    Note that using the serial console and a monitor at the same is
    \emph{not} possible.

    Further information can be found in the appendix under
    \jump{SERIALCONSOLE}{Serial Console}.


  \config{SER\_CONSOLE\_IF}{SER\_CONSOLE\_IF}{SERCONSOLEIF}
  {Number of the serial interface for console output.

    Here you have to enter the number of the interface to which the
    serial console is connected.
    0 corresponds with ttyS0 respectively COM1 from the DOS-realm.}


  \config{SER\_CONSOLE\_RATE}{SER\_CONSOLE\_RATE}{SERCONSOLERATE}
  {Transmission rate of the serial console for console output.

    This is the baud-rate that should be used to transfer data over the
    serial interface. Possible values: 4800, 9600, 19200, 38400, 57600,
    115200}

\end{description}

\section{Ethernet network-adapter drivers}

\begin{description}
  \config{NET\_DRV\_N}{NET\_DRV\_N}{NETDRVN}

  {Number of network-adapter drivers needed.
    
    In case the router is solely used for ISDN, there's normally only
    one NIC (network adapter = Network Interface Card). So the default
    value is 1. If DSL is being used on the other hand, two NICs are used
    in most of the cases.

    There are two possible cases here:
    \begin{enumerate}
    \item Both NICs are of the same type. Therefore only one driver
      needs to be loaded, that then will serve both card, i.e.
      \var{NET\_\-DRV\_\-N}='1'.
      
    \item Two NICs of different type will be used. The variable has
      to be set to `2' and the driver of the second card has to be
      specified.
    \end{enumerate}
    
    From version 1.5 on, token-ring cards\index{token-ring} can be used.
    All the following ethernet-card information applies to them as well.}


  \configlabel{NET\_DRV\_x\_OPTION}{NETDRVxOPTION}
  \config{NET\_DRV\_x  NET\_DRV\_x\_OPTION}{NET\_DRV\_x}{NETDRVx}

  {Network adapter drivers to be loaded

    Using the variable \var{NET\_\-DRV\_\-1} by default a NE2000 compatible
    card driver will be loaded. A lot of entries for available network
    adapter families are present in the sample file.

    The adapter 3COM EtherLinkIII (3c509) needs to be configured using the
    DOS tool 3c509cfg.exe (download from
    \link{ftp://ftp.ihg.uni-duisburg.de/Hardware/3com/3c5x9n/3C5X9CFG.EXE}).

    Interrupt, i/o port and connector type (BNC/TP) should be set when using
    this tool. The variable \var{NET\_\-DRV\_\-x\_\-OPTION}='' can stay
    empty in most cases.

    Drivers for some ISA adapters need additional information so they can
    find the card - e.g. the i/o-address. This is the case for NE2000
    compatible ISA adapters an the EtherExpress16 for example.

    A possible entry would look like:
\begin{example}
\begin{verbatim}
        NET_DRV_x_OPTION='io=0x340'
\end{verbatim}
\end{example}

    (replace the number with the appropriate value).

    If there is no option needed, leave the variable empty.

    If you need several options, use blanks between them. For example:
\begin{example}
\begin{verbatim}
        NET_DRV_x_OPTION='irq=9 io=0x340'
\end{verbatim}
\end{example}

    If you use two identical network adapters, e.g. two NE2000 ISA adapters,
    separate the respective i/o values using commas - e.g.

\begin{example}
\begin{verbatim}
        NET_DRV_x_OPTION='io=0x240,0x300'
\end{verbatim}
\end{example}

    Both values must be separated using a comma and no blanks!

    This won't work with all different drivers.
    Some have to be loaded twice, i.e. \var{NET\_\-DRV\_\-N}='2'.
    You will have to supply a different name for each card using the
    ``-o'' option. For example:

\begin{example}
\begin{verbatim}
          NET_DRV_N='2'
          NET_DRV_1='3c503'
          NET_DRV_1_OPTION='-o 3c503-0 io=0x280'
          NET_DRV_2='3c503'
          NET_DRV_2_OPTION='-o 3c503-1 io=0x300'
\end{verbatim}
\end{example}

    Since I do not use two network adapters in my FLI4L router, I am not
    able to give more detailed information on this.
    My advice is: first try the ``comma method'', then (in case it does not
    work), try to load driver several times and don't forget the ``-o''
    option.

    \wichtig{Those who use two NE clones - one ISA and one PCI adapter -
      had to enter the additional option 'probe\_pci=0' in version 2.0.x.
      This option is not necessary any more.}

    Anybody who gained experience with two network adapters may contact me.
    The information will be added to the documentation.

    Following some examples for configuration of network adapters:

    \begin{itemize}
    \item 1 x NE2000 ISA
\begin{example}
\begin{verbatim}
          NET_DRV_1='ne'
          NET_DRV_1_OPTION='io=0x340'
\end{verbatim}
\end{example}

    \item  1 x 3COM EtherLinkIII (3c509)
\begin{example}
\begin{verbatim}
          NET_DRV_1='3c509'
          NET_DRV_1_OPTION=''
\end{verbatim}
\end{example}
      For more information regarding this card see

      \link{http://www.fli4l.de/german/extern/faq/faq05.htm\#faq5\_18}\\
      \link{http://www.fli4l.de/german/extern/faq/faq05.htm\#faq5\_19}\\
      \link{http://www.fli4l.de/german/extern/faq/faq05.htm\#faq5\_17}\\

    \item 2 x NE2000 ISA
\begin{example}
\begin{verbatim}
          NET_DRV_1='ne'
          NET_DRV_1_OPTION='io=0x320,0x340'
\end{verbatim}
\end{example}

      Often, IRQ values have to be set here:

\begin{example}
\begin{verbatim}
          NET_DRV_1_OPTION='io=0x320,0x340 irq=3,5'
\end{verbatim}
\end{example}

      First try using the network adapter without specifying interrupts.
      Only in case the network adapter is not recognized, add the IRQ
      values.

    \item 2 x NE2000 PCI
\begin{example}
\begin{verbatim}
          NET_DRV_1='ne2k-pci'
          NET_DRV_1_OPTION=''
\end{verbatim}
\end{example}
    \item  1 x NE2000 ISA, 1 x NE2000 PCI
\begin{example}
\begin{verbatim}
          NET_DRV_1='ne'
          NET_DRV_1_OPTION='io=0x340'
          NET_DRV_2='ne2k-pci'
          NET_DRV_2_OPTION=''
\end{verbatim}
\end{example}
    \item 1 x SMC WD8013, 1 x NE2000 ISA
\begin{example}
\begin{verbatim}
          NET_DRV_1='wd'
          NET_DRV_1_OPTION='io=0x270'
          NET_DRV_2='ne2k'
          NET_DRV_2_OPTION='io=0x240'
\end{verbatim}
\end{example}
    \end{itemize}


    A list off all possible drivers (see also the list in the file
    config/base.txt) can be found in the
    \smalljump{tab:kartentreiber}{table of network adapter drivers}.
    \begin{table}[htbp]
      \begin{center}
        \begin{small}
        \begin{tabular}{p{3cm}p{9cm}}
          \var{NET\_\-DRV\_\-x}   &         adapter family \\
          \hline
          `3c505'          &    3COM Etherlink Plus (3c505)\\
          `3c507'          &    3COM Etherlink 16 (3c507)\\
          `3c509'          &    3COM EtherLinkIII (3c509)\\
          `3c515'          &    3COM EtherLink XL ISA (3c515)\\
          `3c59x'          &    3COM Vortex/Boomerang 3c59x,3c900,3c905\\
          `82596'          &    Apricot Xen-II on board Ethernet\\
          `3c503'          &    3COM EtherLinkII (3c503)\\
          `cs89x0'         &    CRYSTAL LAN CS8900/CS8920\\
          `e2100'          &    Cabletron E21xx ISA\\
          `hp'             &    HP PCLAN (27245, 27xxx) ISA\\
          `hp-plus'        &    HP PCLAN+ (27247B and 27252A) ISA\\
          `ne'             &    NE2000 ISA clone\\
          `ne2k-pci'       &    NE2000 PCI clone\\
          `smc-ultra'      &    SMC ULTRA\\
          `wd'             &    SMC WD80*3\\
          `at1700'         &    AT1700 (Fujitsu 86965) ISA\\
          `de4x5'          &    Digital DE425, DE434, DE435, DE450, DE500\\
          `depca'          &    DEPCA, DE10x, DE200, DE201, DE202, DE422\\
          `dgrs'           &    Digi International RightSwitch PCI/EISA\\
          `dmfe'           &    DM9102 compatible PCI cards from Davicom\\
          `elp486'         &    Intel Professional Workstation/panther 82596 (when using the elp486 driver, the IRQ to be used must be set to 10 using the EISA configuration.)\\
          `eepro'          &    Intel EtherExpress Pro/10\\
          `eepro100'       &    Intel EtherExpressPro PCI 10+/100B/100+\\
          `eexpress'       &    EtherExpress16 ISA\\
          `epic100'        &    SMC EPIC/100 (EtherPower II) PCI\\
          `eth16i'         &    ICL EtherTeam 16i/32\\
          `ewrk3'          &    EtherWORKS 3 ISA (DE203, DE204, DE205)\\
          `hp100'          &    HP 10/100VG PCLAN (ISA, EISA, PCI)\\
          `lance'          &    AMD LANCE and PCnet (AT1500, NE2100) ISA\\
          `old\_tulip'     &     Old DECchip Tulip (dc21x4x) PCI\\
          `pcnet32'        &    AMD PCI PCnet32\\
          `rtl8139'        &    RealTek 8129/8139 (not 8019/8029!) PCI\\
          `sis900'         &    SiS 900/7016\\
          `tlan'           &    TI ThunderLAN (Compaq Netelligent \ldots)\\
          `tulip'          &    DECchip Tulip (dc21x4x) PCI\\
          `via-rhine'      &    VIA Rhine PCI (3043, VT86c100A, dfe-530tx)\\

          `lanstreamer'    &    Token Ring: IBM Auto LANStreamer PCI Adapter\\
          `olympic'        &    Token Ring: IBM cards (Pit/Pit-Phy/Olympic)\\
          `ibmtr'          &    Token Ring: IBM 16/4\\

          `pcnet\_cs'      &     PCMCIA: NS8390-based cards (NE2000, DLINK etc)\\
          `3c574\_cs'      &     PCMCIA: 3Com 574\\
          `3c589\_cs'      &     PCMCIA: 3Com 589\\
          `netwave\_cs'    &     PCMCIA: Netwave AirSurfer Wireless LAN\\
          `nmclan\_cs'     &     PCMCIA: New Media Ethernet LAN\\
          `smc91c92\_cs'   &     PCMCIA: SMC91c92-based cards\\
          `wavelan\_cs'    &     PCMCIA: Wavelan\\
          `xirc2ps\_cs'    &     PCMCIA: Xircom: CE2, CEM28, CEM33, or CE3\\

        \end{tabular}
        \end{small}
        \caption{table of possible network adapter drivers}
        \marklabel{tab:kartentreiber}{}
      \end{center}
    \end{table}
    }

\end{description}

\section{Ethernet adapters/networks}

\begin{description}
  \config{IP\_NET\_N}{IP\_NET\_N}{IPNETN}

  {Number of ethernet network adapters or token-ring network adapters
    that should be bound to the IP protocol. That?s usually: '1'.}

  \config{IP\_NET\_x\_DEV}{IP\_NET\_x\_DEV}{IPNETxDEV}

  {Optional: interface name of ethernet adapter.
    Normally, the interface name (a.k.a. device name) will be set
    automatically by fli4l. Names are issued in ascending following order:
    'eth0', 'eth1' etc.
    Only in special cases - e.g.: IP aliasing (more than one IP address on
    one network adapter is used) - manual setting of interface names makes
    any sense.
    Otherwise leave this variable empty.

    \achtung{Changing this variable may lead to errors! If in
      doubt, leave it empty!}
    Example:

\begin{example}
\begin{verbatim}
        IP_NET_1_DEV='eth0'
        IP_NET_2_DEV='eth0:0'
\end{verbatim}
\end{example}

    Default setting: \var{IP\_\-NET\_\-1\_\-DEV}=''}


  \config{IP\_NET\_x}{IP\_NET\_x}{IPNETx}

  {This is the N'th ethernet adapter's IP address. In the example it's
    set to `192.168.6.1'.}

\end{description}

\section{Additional routes (optional)}

\begin{description}
  \config{IP\_DEFAULT\_GATEWAY}{IP\_DEFAULT\_GATEWAY}{IPDEFAULTGATEWAY}

  {If fli4l is used as firewall and/or LAN router and not as an
    internet router, you may specify the IP address of the
    internet router here.
    In most cases \var{IP\_\-DEFAULT\_\-GATEWAY} can stay empty.

    Default setting: \var{IP\_\-DEFAULT\_\-GATEWAY}=''}


  \config{IP\_ROUTE\_N}{IP\_ROUTE\_N}{IPROUTEN}

  {Number of additional network routes. Additional network routes
    are necessary for example, if there is more than one router in
    the network that should be used to access other networks.

    In most cases you will not have to set additional network
    routes.

    Default setting: \var{IP\_\-ROUTE\_\-N}='0'}


  \config{IP\_ROUTE\_x}{IP\_ROUTE\_x}{IPROUTEx}

  {The additional routes \var{IP\_\-ROUTE\_\-1}, \var{IP\_\-ROUTE\_\-2},
    \ldots have the following structure:

\begin{example}
\begin{verbatim}
        network netmask gateway
\end{verbatim}
\end{example}

    For example: The network 192.168.7.0 with netmask 255.255.255.0
    can be reached via the gateway 192.168.6.99, so the correct value
    is:

\begin{example}
\begin{verbatim}
        IP_ROUTE_1='192.168.7.0 255.255.255.0 192.168.6.99'
\end{verbatim}
\end{example}}


  \end{description}



  \section{packet filter}
  \configlabel{ORIG\_FW\_CONFIG}{ORIGFWCONFIG}

  The Linux kernel used by fli4l provides a packet filter. Using this
  packet filter, the communication with the router and between the routed
  networks can be controlled.
  Additionally, features like portforwarding (a packet - originally addressed
  to the router - is being forwarded to an internal host) and masquerading
  (packets originating from a host behind the router are changed, so they
  appear to originate from the router itself) can be realized.
  Two variants are available for configuration: The old one, that had been
  used in version 2.0.x as well - and the new one, that allows a more
  flexible configuration of the packet filter.
  Which one of those will be used is determined by the variables
  \var{ORIG\_FW\_CONFIG} and \var{NEW\_FW\_CONFIG}. Exactly one of them has
  to be set to 'yes'. By default this is \var{ORIG\_FW\_CONFIG}, which
  selects the configuration known from older versions. The following
  explanations apply for this configuration. The new one, because of its
  experimental character, is described in the \jump{NEWFWCONFIG}{Appendix}.

  The structure of the packet filter is indicated in the figure
  \ref{fig:netfilter}.  Packets arrive on one network interface and are
  processed using the pre-routing-chain. Here, packets addressed to the
  router are forwarded to another host by manipulating the target ip
  and the target port, if the router was configured to do so.
  In case the packet is addressed to the router, it is passed to the
  input-chain - otherwise, it is passed to the forward-chain.
  Both chains check, if the packet is valid. If it is accepted, it is
  delivered to the target process or forwarded via the post-routing-chain
  (here, the masquerading happens) to the appropriate network interface so
  it can reach its target.

  \begin{figure}[htbp]
    \centering
    \includegraphics[width=\columnwidth]{netfilter}
    \caption{structure of the packet filter}
    \label{fig:netfilter}
  \end{figure}


\subsection{communication between the routed networks}

  The packet filter will only accept packets from known IP addresses.
  IP addresses are known,  if they originate from a subnet, that has
  been configured in the following variables:
  \begin{itemize}
  \item \var{TRUSTED\_NETS} -- Packets between these subnets are
    forwarded. Communication is not masqueraded or hindered.
  \item \var{ROUTE\_NETWORK} -- Subnets are forwarded.
    Packets addressed to those nets are not masqueraded.
  \item \var{MASQ\_NETWORK} -- Subnets are forwarded and masqueraded.
  \end{itemize}

  A computer is also known if a connection has been established to it.

  Additionally, fli4l applies a Black-/Whitelist (\var{FORWARD\_HOST\_X})
  to the kown IP addresses and also filters specific ports
  \var{FORWARD\_DENY\_PORT\_x}. The figure \ref{fig:forward} shows, how
  the filters are appllied. A matching rule branches off to the top or
  to the bottom. If the rule does not match, the next one is tried.
  In the figure this is symbolized using a arrow pointing to the right.

  A detailed description of the configuration variables follows.

  \begin{figure}[htbp]
    \centering
    \includegraphics[width=\columnwidth]{forward}
    \begin{description}
    \item [PRE/Post] Rules created by the user that have been saved under
      opt/etc/rc.d/fwrules.{pre,post}.*. Those can accept or drop the
      packages.
    \item[TN] Communication between trusted nets is accepted without any
      filtering.
    \item[FDP] Packets targeted to ports mentioned in
      \var{FORWARD\_DENY\_PORT\_x} are dropped.
    \item[BL] If the packet originates from a host mentioned in the
      blacklist, it is dropped.
    \item[WL] If the packet originates from a host mentioned in the
      whitelist, it is not dropped for now (additionally,
      it has to originate from a known net).
    \item[RN] If the packet originates from a host in a subnet mentioned
      in \var{ROUTE\_NETWORK} it is accepted.
    \item[MN] If a packet originates from a host in a subnet mentioned in
      \var{MASQ\_NETWORK}, it is accepted.
    \item[Rel] If the packet belongs to a established connection, it is
      accepted (regardless of its origin).
    \item[All] A rule that matches all packets and drops them.
    \item[Log] The packet is logged to syslog or the console.
    \item[Drop] The packet is dropped.
    \item[Accept] The packet is accepted and therefore forwarded.
    \end{description}
    \caption{Configuration variables and their application}
    \label{fig:forward}
  \end{figure}

    \begin{description}
    \config{MASQ\_NETWORK}{MASQ\_NETWORK}{MASQNETWORK}

    { Here, networks that should be masqueraded towards outside must be
      specified. If you use non-official IP addresses, e.g. 192.168.x.x,
      it is necessary to specify them here in case you want to use fli4l
      as internet router.

      The structure is:

\begin{example}
\begin{verbatim}
        NETWORKNUMBER/NUMBER-OF-SET-BITS-IN-NETMASK
\end{verbatim}
\end{example}

      e.g. for networks of the form 192.168.x.0:

\begin{example}
\begin{verbatim}
        MASQ_NETWORK='192.168.6.0/24'
\end{verbatim}
\end{example}

      I.e., here the first 24 bits are set in the network mask.

      If multiple networks should be masqueraded, they have to be seperated
      using spaces. If no network should be masqueraded, leave the variable
      empty.

      In figure \ref{fig:mn} a packet from a subnet listed in
      \var{MASQ\_NETWORK} passing the firewall is depicted.

  \begin{figure}[htbp]
    \centering
    \includegraphics[width=\columnwidth]{mn}
    \caption{The path of packets from a MASQ\_NETWORK
      through the packet filter}
    \label{fig:mn}
  \end{figure}
}


    \configlabel{MASQ\_MODULE\_x}{MASQMODULEx}
    \configlabel{MASQ\_MODULE\_x\_OPTION}{MASQMODULExOPTION}
    \config{MASQ\_MODULE\_N  MASQ\_MODULE\_x MASQ\_MODULE\_x\_OPTION}{MASQ\_MODULE\_N}{MASQMODULEN}

    { Using IP masquerading \index{Masquerading} has the advantage of
      multiple hosts in the network being able to be routed of one official
      IP address. But there are disadvantages as well.

      A important problem is for example that no host from outside can
      connect to a host autonomously. This may be a positive effect for
      security reasons, but certain protocols won't work any more as they
      just require a connection from outside.

      A classical example is ftp. Besides the communication channel that is
      used to exchange commands and responses, another channel (i.e. IP port)
      is used for transferring the actual data.
      fli4l uses certain masquerading-modules to open such ports on demand
      and forward them to the internal host. The module does this by
      listening in to the data stream to recognize, if and when an additional
      port is required.

      Typical applications for masquerading-modules are chat protocols and
      online games.

      In prior versions, the ftp-module has been loaded automatically. In
      the meantime, additional modules are available.
      These can be called with additional options to, e.g., allow connecting
      to an ftp-server listening on a port other than port 21.
      Follwowing a list of all modules including their parameters. The
      indicated are the defaults.

      \begin{description}
      \item[ftp]             File Transfer Protocol\index{ftp}

        Parameters:
        \begin{description}
        \item[ports=21] Specifies a port this module should watch. If you
          want to connect to a ftp on port 2021 as well, the parameter has
          to be changed to ``ports=21,2021''.
%        \item[in\_ports=] Gibt Ports an, auf denen FTP-Server im
%          maskierten Netz erreicht werden können. Wird z.B. der Port
%          2121 auf einen FTP-Server weitergeleitet, dann lautet dieser
%          Parameter ``in\_ports=2121''. Weitere Ports können, mit
%          Komma getrennt, angegeben werden.
%        \item[noport=6000] Hiermit kann die Sicherheit von
%          FTP-Verbindungen erhöht werden. Hier angegebene Ports können
%          nicht für FTP- Datenverbindungen benutz werden.
%          Standardmäßig sind alle Ports unter 1024 und der Port 6000
%          (X-Windows) gesperrt.  Siehe
%          \link{http://www.securityfocus.com/templates/archive.pike?list=82\&date=2000-03-08\&msg=38C8C8EE.544524B1@enternet.se}{http://www.securityfocus.com/templates/archive.pike?""list=82\&date=2000-03-08""\&msg=38C8C8EE.544524B1@enternet.se}
%        \item[mark=0]
%        \item[in\_mark=0] Werden diese Optionen auf ``1'' gestellt,
%          werden die FTP-Pakete für die Firewall markiert. Diese
%          Option ist nur für erfahrene Benutzer relevant.
        \end{description}

      \item[irc] Internet Relay Chat\index{irc}

        Parameters:
        \begin{description}
        \item[ports=6667] Specifies the ports, on which you want to connect
          to IRC servers.
%        \item[insecure=0] Auf ``1'' setzen, um einige
%          Sicherheitsabfragen auszuschalten.
        \end{description}
        Annotations: mIRC\index{mIRC} is misconfigured by default, so it
        won't work with this module. To correct the configuration proceed
        as following (disconnect from IRC server first):
        Go to the ``Options'' dialog: Tab ``Connect'', ``Local
        Info''. Clear both text boxes if non-empty. Finally change ``Lookup
        Method'' to ``Normal''.

%      \item[h323] H323-Telefonie (z.B. Netmeeting)\index{h323}
%
%        Parameter: keine, horcht immer auf Port 1720
%
%        Bemerkungen: Das h323-Modul ermöglicht IP-Telefonie über das
%        Internet. MS-Netmeeting benutzt dieses Protokoll ebenfalls.
%        Damit `Anrufe' an den Client durchgestellt werden können,
%        müssen die TCP Ports 1503 (T.120) und 1720 (H.323 call setup)
%        an den Client weitergeleitet werden (siehe
%                \jump{OPTPORTFW}{OPT\_PORTFW}).
%
%        Homepage:
%        \link{http://www.coritel.it/coritel/ip/sofia/nat/nat2/nat2.htm}
%
%      \item[icq] ICQ - Instant Messenging Service\index{ICQ}
%
%        Parameter:
%        \begin{description}
%        \item[ports=4000] Gibt Ports an, die das Modul auf
%          Verbindungen zu einem ICQ-Server überwachen soll.
%        \item[range=60200,61000] Gibt Ports an, die für
%          Dateiübertragungen benutzt werden sollen.
%        \item[udp\_timeout=600] Wie lange (in Sekunden) soll ein
%          UDP-Paket gültig sein?
%        \item[tcp\_timeout=14400] Wie lange soll eine TCP-Verbindung
%          gültig sein? Da über eine solche Verbindung
%          User-2-User-Chats laufen, wo möglicherweise lange nichts
%          gesagt wird, sollte dieser Wert entsprechend hoch sein. (4
%          Stunden ist Standard)
%        \item[tcp\_fin\_timeout=60] Diese Option einfach so lassen!
%        \item[log=i] Was soll geloggt werden? Hier kann eine Reihe von
%          Buchstaben angegeben werden, bitte in der Orginal- README
%          des Modules nachlesen.
%        \item[limit=512] Beschränkt einige Optionen, damit kein
%          Speicherüberlauf produziert werden kann.
%        \item[hide\_local\_ip=1] IP-Adresse des internen Netzes mit
%          der externen IP ersetzen oder nicht?
%        \item[hide\_remote\_local\_ip=0] Echte IP-Adresse andere
%          Benutzer verstecken?
%        \item[intranet=1] Direktverbindung zwischen zwei ICQ-Benutzern
%          hinter dem gleichen Router erlauben.
%        \end{description}
%        Bemerkungen: Funktionert mit allen ICQ-Versionen bis 99, die
%        2000er funktioneren nicht. Wie es mit 2001 steht, ist noch
%        nicht geklärt.
%
%        Homepage: \link{http://djsf.narod.ru/masq-icq/} (geht zur Zeit
%        noch\ldots)
%
%      \item[raudio] Real Audio\index{Real Audio}
%
%        Parameter:
%        \begin{description}
%        \item[ports=554,7070] Gibt die Ports an, auf denen PNA- und
%          RTSP-Streams übertragen werden.
%        \end{description}
%
%      \item[vdolive] VDOLive
%
%        Parameter:
%        \begin{description}
%        \item[ports=7000] Gibt die VDOLive-Ports an.
%        \end{description}
%
%      \item[quake] Quake\index{Quake}
%
%        Parameter: keine, horcht immer auf Port 26000 und 27000
%
%      \item[cuseeme] CUSeeMe\index{CUSeeMe}
%
%        Parameter:
%        \begin{description}
%        \item[ports=7648] Gibt die CUSeeMe-Ports an.
%        \end{description}
%
%      \item[mms] Microsoft Messenger\index{Microsoft Messenger}
%
%        Parameter:
%        \begin{description}
%        \item[ports=1863] Gibt die Ports des MMS-Servers an.
%        \end{description}
%        Homepage:
%        \link{http://lrp.steinkuehler.net/files/kernels/2.2.19-3-source/patches/files/mmsmasq/}
%
%      \item[pptp] PPTP Masquerading
%
%        Parameter: keine, horcht immer auf 1723
%
%      \item[ipsec] IPSec Masquerading
%
%        Parameter: keine, horcht immer auf 500
%
%      \item[dplay] Direct Play\index{Direct Play}
%
%        Parameter:
%        \begin{description}
%        \item[host=$<$ip$>$] Gibt einen Rechner an, an den alle
%          eingehenden DirectPlay-Anfragen weitergeleitet werden.
%        \end{description}
%        Bemerkungen: Zwei Spieler können nicht auf dem gleichen Server
%        spielen. Steht der Server im maskierten Netz, gehen Pakete von
%        externen Spielern an interne teilweise verloren.
%
%        Homepage: \link{http://dplay-masq.sourceforge.net/}
%
%      \item[msn-0.01] MSN Game Zone - Version 0.01\index{MSN Game
%          Zone}
%      \item[msn-0.02] MSN Game Zone - Version 0.02 (beta)
%
%        Parameter: keine, horcht immer auf 47624
%
%        Bemerkungen: Das 0.02er Modul sollte meistens funktionieren.
%
%        Homepage: \link{http://user.rli.net/kevin/masq.html}
%
%      \item[udp\_dloose] UDP-Loose-Patch, hilft bei manchen
%        Internet-Spielen
%
%        Bemerkungen: Das hier ist eigentlich kein Masqerading-Modul,
%        sondern ein Kernel-Schalter, der einige Restiktionen in der
%        Firewall aufhebt, so daß mehr Pakete ihr Ziel erreichen. Die
%        unten genannte Internet-Seite gibt detailierte Informationen.
%
%        Homepage: \link{http://alumni.caltech.edu/~dank/peer-nat.html}


      \end{description}


      \achtung{All parameters that can be set to a list of ports, have a
      maximum of 12 ports.}

      Of course you can't program a masquerading module for each and every
      protocol that uses additional ports. Therefore there is another
      possibility how ports can be forwarded to internal hosts - see
      \jump{OPTPORTFW}{OPT\_PORTFW} (Port forwarding).

          Another tip: On \link{http://www.fli4l.de} there is a special
          FAQ covering the topic of Port forwarding.


      Now, the corresponding configuration variables are described:

      \var{MASQ\_\-MODULE\_\-N} specifies the number of masquerading modules
      to be loaded. \var{MASQ\_\-MODULE\_\-x} specifies the x'th
      masquerading module to be loaded. Additionally,
      \var{MASQ\_\-MODULE\_\-x\_\-OPTION} specifies the parameter of the
      corresponding masquerading module. Here, the parameters described
      above can be specified, seperated by blanks.

      The default setting for \var{MASQ\_\-MODULE\_\-N} is `1'. Using that
      setting, only the first module is loaded - i.e. ftp. If you need more
      modules, you have to increase \var{MASQ\_\-MODULE\_\-N}
      correspondingly.
      The order of the modules contained in the file config/base.txt is only
      an example. It can be customized to your needs, e.g.

\begin{example}
\begin{verbatim}
        MASQ_MODULE_N='1'
        MASQ_MODULE_1='ftp'
        MASQ_MODULE_1_OPTION='ports=21,2121'
        MASQ_MODULE_2='irc'
        MASQ_MODULE_2_OPTION=''
\end{verbatim}
\end{example}

%        MASQ_MODULE_1='ftp'
%        MASQ_MODULE_1_OPTION='ports=21,2121 in_ports=5021,6021'

      Additional contents of \var{MASQ\_\-MODULE\_\-x} are ignored.

      Note the example of the parameters of the ftp-module supplied with
      this example as well. }

    \config{ROUTE\_NETWORK}{ROUTE\_NETWORK}{ROUTENETWORK}

    { Packets that belong to a connection from hosts in these subnets
      are forwarded by the router. Additionally, packets that are addressed
      to these nets, are not masqueraded.

      This can be useful for example, if a employee should have access to
      the internal network of the company via such a connection. The format
      is the same as the format of \var{MASQ\_\-NETWORK}, for example

\begin{example}
\begin{verbatim}
        ROUTE_NETWORK='192.168.1.0/24'
\end{verbatim}
\end{example}

Here, too, several networks can be specified.

      \var{ROUTE\_\-NETWORK} can stay empty in most cases.}

How packet from a \var{ROUTE\_\-NETWORK} passes the packet filter can be seen in the figure \ref{fig:tn} (it is the same route a packet from a \var{TRUSTED\_\-NET} would take).

  \begin{figure}[htbp]
    \centering
    \includegraphics[width=\columnwidth]{tn}
    \begin{description}
    \item[SRN] The packet originates from a subnet specified in
      \var{ROUTE\_\-NETWORK}.
    \item[DRN] The packet should be forwarded to a subnet specified in
      \var{ROUTE\_\-NETWORK}.
    \end{description}
    \caption{A packet from a TRUSTED\_NET or ROUTE\_NETWORK passing
      the packet filter}
    \label{fig:tn}
  \end{figure}

    \config{FORWARD\_HOST\_WHITE}{FORWARD\_HOST\_WHITE}{FORWARDHOSTWHITE}

    { There are situation when you explicitely want to allow several
      hosts to access other networks (whitelist) or vice versa want to
      deny several hosts access to other networks (blacklist).
      When you use this concept, the packet filter forwards only packets
      of the specified hosts or blocks the packets of the hosts.
      If \var{FORWARD\_\-HOST\_\-WHITE} is set to yes, the subsequent
      enumeration represents a whitelist, otherwise a blacklist.

      If you want to allow all hosts to communicate throught the router
      you simply define an empty blacklist (FORWARD\_HOST\_WHITE='no' and
      \var{FORWARD\_\-HOST\_\-N}='0'). This is the default setting.

    \configlabel{FORWARD\_HOST\_x}{FORWARDHOSTx}
    \config{FORWARD\_HOST\_N FORWARD\_HOST\_x}{FORWARD\_HOST\_N}{FORWARDHOSTN}

    Here, the host in the white- or blacklist are specified, e.g.:
\begin{example}
\begin{verbatim}
        FORWARD_HOST_N='2'
        FORWARD_HOST_1='192.168.6.5'
        FORWARD_HOST_2='192.168.6.6'
\end{verbatim}
\end{example}
    }

    Packets originating from one of those two hosts are the only packets
    forwarded by the router in case of a whitelist. In case of a blacklist
    those packets are blocked.

    \configlabel{FORWARD\_DENY\_PORT\_x} {FORWARDDENYPORTx}
    \config{FORWARD\_DENY\_PORT\_N FORWARD\_DENY\_PORT\_x}{FORWARD\_DENY\_PORT\_N}{FORWARDDENYPORTN}

    {
      Using these variables you can block routing over specific IP-Ports.
      It is for example useful if you deny forwarding of the Netbios-Ports
      137-139. Not only forwarding to the outside world is blocked but
      routing of these ports between two LANs as well.

      If you use multiple network cards for multiple subnets and want
      clients to be able to access windows shares on an other subnet,
      the forwarding should not be blocked here. However, you can
      specify networks in  \var{TRUSTED\_\-NETS} (see above), where
      routing is allowed between explicitely.

      An example: Block napster services:
\begin{example}
\begin{verbatim}
        FORWARD_DENY_PORT_N='6'         # Anzahl
        FORWARD_DENY_PORT_1='137:139'   # NetBios-Ports 137 bis 139
        FORWARD_DENY_PORT_2='8888'      # Napster Port 8888
        FORWARD_DENY_PORT_3='7777'      # Napster Port 7777
        FORWARD_DENY_PORT_4='7000'      # Napster Port 7000
        FORWARD_DENY_PORT_5='4444'      # Napster Port 4444
        FORWARD_DENY_PORT_6='4200'      # Napster Port 4200
\end{verbatim}
\end{example}
    }
    \config{TRUSTED\_NETS}{TRUSTED\_NETS}{TRUSTEDNETS}

    { Rules to block specific ports via \var{FORWARD\_\-DENY\_\-PORT\_\-x}
      or hosts via the black-/whitelist (\var{FORWARD\_DENY\_HOST}) can be
      deactivated for specifig networks using \var{TRUSTED\_\-NETS}.
      Here you can specify networks, that are {\em trusted}. A typical
      example is routing netbios-ports between two LANs., that are
      connected using two NICs of the fli4l. In this case, you have to
      specify alle trusted networks, e.g.

\begin{example}
\begin{verbatim}
        TRUSTED_NETS='192.168.1.0/24 192.168.6.0/24'
\end{verbatim}
\end{example}

      In contrast to the variable \var{MASQ\_\-NETWORK}, it is necessary
      to specify all networks you want packets to be forwarded between.
      I.e. you need to specify at least two subnets so that the needed
      iptables-rules can be correctly generated!

      How a packet from a \var{ROUTE\_\-NETWORK} passes the packet filter,
      is depicted in figure \ref{fig:tn} (is it the same route a packet
      from a \var{TRUSTED\_\-NET} would take).

      Default setting: \var{TRUSTED\_\-NETS}=''


    }
    \item[Other networks]

    As stated in the introductive comments, the router forwards only packets
    from networks that are known. But as you do not know all networks
    you later want to communicate with at the outset, the router logs
    established connections and lets packets corresponding to such a
    connection pass. How such a packet passes the packet filter can be
    seen in figure \ref{fig:other}.

  \begin{figure}[htbp]
    \centering
    \includegraphics[width=\columnwidth]{other}
    \caption{A packet from a unknown net passes the packet filter}
    \label{fig:other}
  \end{figure}


  \end{description}


\subsection{Communication with the router}

The preceding configuration did only describe, how hosts communicate
via the router. Now let's have a look at the communication with the
router. As fli4l runs services on several ports, it makes sense to protect
them from remote access.

\wichtig{The LAN that is masqueraded by the router (see above) is
  generally speaking protect from remote access. The port numbers specified
  therefore only restrict remote access to the router itself.}

The services and ports described in the table \ref{tab:deny-ports} are of
special interest. Hosts from networks listed in \var{MASQ\_NETWORK},
\var{ROUTE\_NETWORK} and \var{TRUSTED\_NETS}, can access the router,
whereas the ports are blocked for other networks. If you want to provide
a service to others, the corresponding port has to be opened using the
variables \var{INPUT\_\-ACCEPT\_\-PORT\_\-x}.

      \begin{table}[htbp]
        \begin{center}

          \begin{tabular}{lll}
            Port       &     Name          &          Process \\
            \hline
            22       &     ssh           &          sshd\\
            37       &     time          &          $<$kernel$>$\\
            53       &     domain        &          ens\\
            80       &    www            &         mini\_httpd\\
            137:139   &     netbios       &          smbd (samba)\\
            515       &     printer       &          lpd\\
            5000       &     $<$imond$>$       &          imond\\
            5001       &     $<$telmond$>$     &          telmond\\
            8000       &    $<$proxy$>$        &         pivoxy\\

          \end{tabular}
          \caption{Ports, fli4l provides services on}
          \label{tab:deny-ports}
        \end{center}
      \end{table}


      Is it {\bf highly} recommended, not to change the standard
      configuration of the firewall-ports.
  \begin{description}

    \configlabel{INPUT\_ACCEPT\_PORT\_x} {INPUTACCEPTPORTx}

    \config{INPUT\_ACCEPT\_PORT\_N INPUT\_ACCEPT\_PORT\_x}{INPUT\_ACCEPT\_PORT\_N}{INPUTACCEPTPORTN}

    In the standard configuration, all ports are closed for remote hosts.
    It is not possible to connect to the router. Ports you want to use
    to provide a service to the outside world have to be specified here.

    An entry consist of a single port or a port-range (two ports seperated
    by a colon) and an optional specification of the protocol (TCP or UDP).
    If no protocol is specified, both protocols are accepted on the port.
    If you would want to accept ssh connections (on port 22/tcp), the entry
    would have to look like this:

\begin{example}
\begin{verbatim}
INPUT_ACCEPT_PORT_N='1'             # no. of ports to accept from outside
INPUT_ACCEPT_PORT_1='22 TCP'        # e.g. allow connection to ssh service
\end{verbatim}
\end{example}

    \config{INPUT\_POLICY}{INPUT\_POLICY}{INPUTPOLICY}

    If the router receives a packet that is not allowed to pass because of
    the configuration, it has two possibilities: It can just drop the
    packet({\em DROP}) or reject it ({\em REJECT}) and inform the sender
    of what has happened. How the router reacts is specified here. The
    default reaction is {\em REJECT}.

    If the policy is set to {\em DROP} it keeps silent -- what may lead
    to problems. For example, some servers that provide services like ftp,
    try to connect to port 113(auth) in response to a connection request.
    If fli4l does not react at all, this can lead to a unwanted disconnect.

      Personally, i prefer the policy {\em REJECT}, as it results in less
      problems with various internet protocols and it is just as save as
      DENY.

      Additional information on the issue wheter to use {\em REJECT} or
      {\em DROP}:

      \link{http://www.iks-jena.de/mitarb/lutz/usenet/Firewall.html\#Deny}\\
      \link{http://www.chiark.greenend.org.uk/~peterb/network/drop-vs-reject}

    \config{DENY\_ICMP}{DENY\_ICMP}{DENYICMP}

    { if you want to prohibit ICMP request from remote (echo requests),
      \var{FIREWALL\_\-DENY\_\-ICMP} can be set to 'yes'. In this case you
      will not be able to ping the router from remote hosts. Before using
      this variable, it is highly recommended to visit these web pages:

      \link{http://www.iks-jena.de/mitarb/lutz/usenet/Firewall.html\#Verstecken}\\
      \link{http://www.fli4l.de/faq/index.php?sid=\&aktion=anzeigen\&rubrik=3\&id=165}\\

      Default setting: \var{DENY\_\-ICMP}='no'}


    \config{PACKETFILTER\_LOG}{PACKETFILTER\_LOG}{PACKETFILTERLOG}

    { Here you can specify, if rejected request from remote should be
      logged using the syslog interface.

      Following is a short description of the most important elements of
      a logged line:
\begin{example}
\begin{verbatim}
IN=ppp0 OUT= MAC= SRC=217.238.54.176 DST=217.235.38.43 LEN=48
    TOS=0x00 PREC=0x00 TTL=124 ID=30343 DF PROTO=TCP SPT=3087
    DPT=4662 WINDOW=16384 RES=0x00 SYN URGP=0
\end{verbatim}
\end{example}

      \begin{tabular}{ll}
        IN          &  Device from which the packet came in\\
        SRC, DST    &  Source and target address of the packet\\
        LEN         &  Length of the packet in bytes\\
        TOS         &  Type of service\\
        TTL         &  Time to live, number of hops, until the packet is deleted\\
        PROTO=TCP   &  TCP packet\\
        SPT, DPT    &  source and target port\\
        ID          &  IP-ID - every packet from sender it is increment by one\\
      \end{tabular}

      Default setting: \var{PACKETFILTER\_\-LOG}='no'
      }

  \end{description}

  \section{Domain-Configuration}


  Windows-PCs in the LAN have one (besides other *g*) unpleasant misfeature:
  When a nameserver is needed and you configure windows to use one, it
  queries them every few minutes (here, it's 5 minutes) - even if you don't
  use the computer!

  So as soon as you specify a DNS server from the internet in windows, you
  would have to pay lots of money for nothing :-(

  So this is the trick: If there is no DNS server already available in the
  LAN, you can use the DNS builtin with fli4l.

  Since fli4l version 1.5.2 ENS is used as DNS server. It replaces the
  priorly used dnscache/tinydns and named(bind).

  But before you start configuring you DNS, you should think of how you
  domain should be named and how you want to name you hosts in the LAN.
  The domain name you use will not be visible from the internet. Therefore,
  virtually any domain name can be chosen.

  Additionally, you should give every windows-client a name. Those have to
  be known to the fli4l router.

  \begin{description}

    \config{START\_DNS}{START\_DNS}{STARTDNS}

    {
      If there are no windows clients in the LAN or there is already a
      DNS server available, you can set \var{START\_\-DNS} to `no' and
      ignore the rest of this section.

      If in doubt (default setting): \var{START\_\-DNS}='yes'}


    \config{DNS\_FORWARDERS}{DNS\_FORWARDERS}{DNSFORWARDERS}

    {
      Here you should specify the address of the DNS server of your
      internet provider, if fli4l is used as internet router. Fli4l will
      forward all DNS queries he is unable to answer itself to this address.

      If you want to specify more than one DNS forwarder, the IP addresses
      have to be seperated by blanks.

      \achtung{Attention: Even if
        \begin{itemize}
        \item \jump{PPPOEUSEPEERDNS}{PPPOE\_USEPEERDNS},
        \item \jump{ISDNCIRCxUSEPEERDNS}{ISDN\_CIRC\_x\_USEPEERDNS}
          oder
        \item \jump{DHCLIENTUSEPEERDNS}{DHCLIENT\_USEPEERDNS}
        \end{itemize}


        is set to 'yes', you have to enter a server here. In the first few
        seconds after the connection has been established, you won't be
        able to resolve names, otherwise.}

      Exception: fli4l as router in the LAN \_without\_ internet connection
      or a LAN with additional DNS servers. In this case you should specify
      127.0.0.1 to prevent forwarding.

      For DNS access it is necessary not to block port 53.  }

    \config{DNS\_VERBOSE}{DNS\_VERBOSE}{DNSVERBOSE}

    { Logging of DNS queries: `yes' or `no'

      This variable is only used, if the program named is used as DNS server,
      i.e. if \var{DNS\_\-FORWARDERS} is set to a value. In that case queries
      to the DNS server are logged to the syslog interface. To be able to
      see them you will have to set  \jump{OPTSYSLOGD}{OPT\_SYSLOGD} to
      'yes', see below.}


    \config{DOMAIN\_NAME}{DOMAIN\_NAME}{DOMAINNAME}

    {By default, the domain name is simply set to``lan.fli4l''. The domain
    name will not be visible on the internet, so enter any value you
    like.
    Just avoid a domain possibly already on the internet (something.com,
    e.g.) as you won't be able to access it otherwise.}

    \configlabel{DNS\_FORBIDDEN\_x}{DNSFORBIDDENx}
    \config{DNS\_FORBIDDEN\_N DNS\_FORBIDDEN\_x}{DNS\_FORBIDDEN\_N}{DNSFORBIDDENN}

    {Here you can specify domains, that you won't the DNS server not
      to resolve. It will just reply with  ``not existing''.

      Example:

\begin{example}
\begin{verbatim}
        DNS_FORBIDDEN_N='1'
        DNS_FORBIDDEN_1='foo.bar'
\end{verbatim}
\end{example}

      In this case a query for www.foo.bar will lead to an error.

      You may specify toplevel domains as well:

\begin{example}
\begin{verbatim}
        DNS_FORBIDDEN_1='de'
\end{verbatim}
\end{example}

      In this case resolving of names of all .de domain is deactivated
      for all hosts.}


    \configlabel{HOST\_x\_NAME}{HOSTxNAME}
    \configlabel{HOST\_x\_IP}{HOSTxIP}
    \configlabel{HOST\_x\_ALIAS\_N}{HOSTxALIASN}
    \configlabel{HOST\_x\_ALIAS\_x}{HOSTxALIASx}
    \configlabel{HOST\_x\_MAC}{HOSTxMAC}
    \config{HOSTS\_N  HOST\_x\_\{attribute\}}{HOSTSN}{HOSTSN}

    {All hosts in the LAN should be described - IP addresses, names, aliases
      and MAC addresses where appropriate. First, set the number of hosts
      (including the fli4l router) using the variable \var{HOSTS\_\-N}.

      Then, define the attributes of the hosts, like IP address and names -
      the other ones are optional, i.e. you can but do not have to specify
      them.

      \begin{description}
      \item[NAME]         -- Name of the n'th host
      \item[IP]           -- IP address of the n'th host
      \item[ALIAS\_N]     -- Number of aliases for the n'th host
      \item[ALIAS\_m]     -- m'th alias name of the n'th host
      \item[MAC]          -- MAC adresses of the n'th host
      \end{description}



      In the sample file there are 4 host configured - the hosts ``fli4l'',
      ``client2'', ``client3'' and ``client4''. ``fli4l'' is the router
      itself (identical with HOSTNAME, see above). It makes sense to specify
      hosts here, even if they are not allowed to use the router as gateway
      to another network (see \jump{FORWARDHOSTN}{FORWARD\_HOST\_N}), so
      they can be accessed from other hosts in the LAN using the name.
      The entry for the router itself for example looks like this (it has no
      aliases and does not need a MAC address, as it is not configured by the
      dhcpd):

\begin{example}
\begin{verbatim}
         HOST_1_NAME='fli4l'                 # 1st host: ip and name
         HOST_1_IP='192.168.6.1'
\end{verbatim}
\end{example}

      Alias names have to be specified including the full domain name.

      The MAC address is optional and only relevant, if fli4l is used
      as DHCP server as well. You can find information on this topic
      in the description of the optional package ``\var{OPT\_\-DHCP}'',
      see below. In case fli4l is not used as DHCP server, only the IP
      address, the name and maybe the alias names have to be set.
      The MAC address is a 48 bit address and consists of 6 hex values,
      each of them seperated by colons - e.g.

\begin{example}
\begin{verbatim}
        HOST_2_MAC='de:ad:af:fe:07:19'
\end{verbatim}
\end{example}
      }


    \config{MX\_N}{MX\_N}{MXN}
    
    {In fli4l, you may now define MX recors (mail exchanger). This makes
      sense for example, if multiple internal domains are used and mails
      directed to these domains should not be delivered using the internet
      but via the internal network. A MTA (mail transport agent) (like, for
      example, sendmail) on a local server asks the DNS for a MX for the
      target domain he wants deliver mail to.

      \achtung{This is no automatic configuration for mail clients like
      Outlook! So please do not enter hotmail.com here and wonder, why
      Outlook does not work.}

      The variable MX\_N specifies the number of set MX records.}


    \config{MX\_x\_DOMAIN}{MX\_x\_DOMAIN}{MXxDOMAIN}

    {Here you can specify the domain, the MX record is responsible for}

    \config{MX\_x\_SERVER}{MX\_x\_SERVER}{MXxSERVER}

    {The servername including domain of the MX}

    \config{MX\_x\_PRIORITY}{MX\_x\_PRIORITY}{MXxPRIORITY}

    {The priority of the MX. Lower values mean a higher priority because
    they are ``closer to the target''. You may specify multiple MX records
    for a single domain in case there a multiple MXs available for a target
    domain. In case the best MX (that has the lowest priority-number) is
    not reachable, the mail is delivered to the alternative servers.

    If you want to optimize mail transport using MX records, you should
    read a book dealing with this special topic.}

  \end{description}

  \section{Special DNS servers}

  \begin{description}

    \configlabel{DNS\_x}{DNSx}
    \config{DNS\_N  DNS\_x}{DNS\_N}{DNSN}
    
    { There are situations, when it makes sense to specify one or more
      DNS servers. If fli4l is used in a LAN without internet connection or
      a mix of those (LAN with internal DNS server and additional internet
      connection) for example.

      Imagine the following scenario:

      \begin{itemize}
      \item Circuit 1: Connection to the internet
      \item Circuit 2: Connection to your company's network 192.168.1.0 (company.com)
      \end{itemize}


      In that case you set \var{ISDN\_\-CIRC\_\-1\_\-ROUTE} to `0.0.0.0' and
      \var{ISDN\_\-CIRC\_\-2\_\-ROUTE} to `192.168.1.0'. When a hosts with IP
      address 192.168.1.x is accessed, fli4l uses circuit 2, otherwise
      circuit 1 is used. If the company network is not public, most likely
      an internal name server is in use. Assuming, the address of this DNS
      server is 192.168.1.12 and the domain name is ``company.com'', you
      have to specify:

\begin{example}
\begin{verbatim}
        DNS_SPECIAL_N='1'
        DNS_SPECIAL_1='company.com 192.168.1.12'
\end{verbatim}
\end{example}

      Then, for DNS queries from xx.company.com the internal, otherwise
      the DNS server on the internet is used.


      Another case:
      \begin{itemize}
      \item Circuit 1: Internet
      \item Circuit 2: Company's network 192.168.1.0 *with* access to the internet
      \end{itemize}

      Here you can reach the internet using two ways. In case you want
      to seperate private and business affairs, the following makes sense:

\begin{example}
\begin{verbatim}
        ISDN_CIRC_1_ROUTE='0.0.0.0'
        ISDN_CIRC_2_ROUTE='0.0.0.0'
\end{verbatim}
\end{example}

      So you set both circuits to the default router and switch
      routes using the imond client - you decide. In this case, too, you
      should set \var{DNS\_\-N} and \var{DNS\_\-N} like described above.}

  \end{description}

  \section{imond configuration}

  \begin{description}

    \config{START\_IMOND}{START\_IMOND}{STARTIMOND}

    {Using \var{START\_\-IMOND} you can decide, whether the imond server
      should be activated. imond is responsible for monitoring/controlling
      and least cost routing of the fli4l router.
      Therefore, there is a seperate section describing imond (see below).

      Important. The LC routing feature of fli4l can be only using together
      with imond. Switching connections based on time without using imond
      is not possible!

      For ISDN and DSL routing is mandatory since version 1.5 to use imond.
      In this case, set \var{START\_\-IMOND}='yes'.

      If fli4l is only used as router between two ETH-networks, you should
      set \var{START\_\-IMOND}='no'.

      Default setting: \var{START\_\-IMOND}='no'}


    \config{IMOND\_PORT}{IMOND\_PORT}{IMONDPORT}

    {TCP/IP port the imond listens for connections on. The default value
    `5000' should only be changed if absolutely necessary.}


    \config{IMOND\_PASS}{IMOND\_PASS}{IMONDPASS}

    {Here, a special user password for imond can be set. If a client connects
      on port 5000, imond (and therefore its clients) exspect(s) this
      passwort before it responds to any command. Exception: The commands
      ``quit'', ``help'' and ``pass''.  If \var{IMOND\_\-PASS} is empty,
      no password is needed.

      Wheter the client can execute the user command like dial, hangup,
      reboot and changing the default route or if its necessary to enter
      the admin pass is changed via the variables
      \begin{itemize}
      \item \jump{IMONDENABLE}{IMOND\_ENABLE},
      \item \jump{IMONDENABLE}{IMOND\_DIAL},
      \item \jump{IMONDENABLE}{IMOND\_ROUTE} und
      \item \jump{IMONDENABLE}{IMOND\_REBOOT}
      \end{itemize}

      see below.

      Default setting: \var{IMOND\_\-PASS}=''}


    \config{IMOND\_ADMIN\_PASS}{IMOND\_ADMIN\_PASS}{IMONDADMINPASS}

    { Using the admin password, the client gaines all rights and is therefore
      able to use all control commands of the imond server - regardless of
      wheter the variables \var{IMOND\_\-ENABLE}, \var{IMOND\_\-ENABLE} etc.
      are set.
      If \var{IMOND\_\-ADMIN\_\-PASS} are left empty, the user password
      is necessary to gain all rights!

      Standard-Einstellung: \var{IMOND\_\-PASS}=''
    }


    \config{IMOND\_LED}{IMOND\_LED}{IMONDLED}

    {imond can display the online/offline status using a LED.
      It is connect to the COM port like this:

      Connection 25-pins:

\begin{example}
\begin{verbatim}
        20 DTR  -------- 1kOhm ----- >| ---------- 7 GND
\end{verbatim}
\end{example}


      Connection 9-pins:
\begin{example}
\begin{verbatim}
         4 DTR  -------- 1kOhm ----- >| ---------- 5 GND
\end{verbatim}
\end{example}

      If there is a ISDN or DSL connection established, the LED is lit.
      Otherwise it is deactivated. If you want it the other way around,
      you have to reverse the polarity of it. In case the LED is too weak,
      the multiplier can be reduced to 470 Ohm.

      It is possible to connect two LEDs of different color. The second
      LED has be connected using a multiplier between DTR and GND, but just
      the other way around. Then, just one of the LED is lit - depending
      on the online status. You could as well used a DUO-LED (two colors,
      3 connectors).

      Momentarily, the RTS connector of the the serial interface behaves
      hust like DTR. So you could connect another LED here, that displays
      the online/offline status. This could change in a future version of
      fli4l.

      As value of \var{IMOND\_\-LED} a COM port has to be specified, i.e.
      `com1', `com2', `com3' or `com4'. If no LED is connected, you should
      leave this variable empty.}


    \config{IMOND\_BEEP}{IMOND\_BEEP}{IMONDBEEP}

    {When \var{IMOND\_\-BEEP}='yes' is set, imond beeps two times on online
      status change. When the status changes from offline to online, a
      TBD: hoher/tiefer ton?
      Im ersten Fall wird zuerst ein tiefer,
      dann ein hoher Ton ausgegeben. Beim Wechsel in den
      Offline-Status zurück wird zuerst der höhere, dann der tiefere
      Ton ausgegeben.}


    \config{IMOND\_LOG}{IMOND\_LOG}{IMONDLOG}

    {When \var{IMOND\_\-LOG}='yes' is set, connections are logged to
      /var/log/imond.log. This file can be copied for analysis to a host
      in the LAN using, for example, scp. If you want to use scp you will
      have to have the sshd installed and configured, so that it provides
      scp.

      The format of the logfile entries is descriebed in the table
      \ref{tab:imondlog}.
      \begin{table}[htbp]
        \begin{tabular}[h!]{|l|p{10cm}|}
          \hline
          Entry & Meaning \\
          \hline \hline
          Circuit & name of the circuit, that triggered the log event \\
          Start time & date and time when the connection to the circuit was established \\
          Stop time & date and time when the connection was terminated \\
          Online time & duration of the connection \\
          Charged time & duration, the provider will charge you (depending
          on
          TBD: takt?
          ) \\
          Charge & how much your provider will charge you for this connection \\
          Bandwidth & the used bandwidth, seperated by in an out (in first),
          as two unsigned integer values. Note: Bandwidth = $4GByte*<first
          number>+<second number>$ \\
          Device & the device used for communication \\

          TBD: Takt, die zweite.
          Abrechnungstakt & der Takt, das vom Provider zur
          Abrechnung herangezogen wird (Daten der Circuit-Konfiguration)\\
          Taktgebühren & die Gebühren, die pro Takt fällig werden
          (Daten der Circuit-Konfiguration)\\
          \hline
        \end{tabular}
        \caption{file format of the imond logfiles}
        \label{tab:imondlog}
      \end{table}

      Charge is displayed in Euro. It is important for this function that the
      corresponding circuit variables
      \jump{ISDNCIRCxTIMES}{ISDN\_CIRC\_x\_TIMES} are correctly set.

      Default setting: \var{IMOND\_\-LOG}='no'}


    \config{IMOND\_LOGDIR}{IMOND\_LOGDIR}{IMONDLOGDIR}

    {If the logging is enabled, a alternative directory for the logfile can
      be set using \var{IMOND\_\-LOGDIR}, replacing /var/log, e.g. `/boot'.        In this case, the log file imond.log is created on the disk. The disk
      has to be ``mounted'' read/write for this to work.}


    \configlabel{IMOND\_DIAL}{IMONDDIAL}
    \configlabel{IMOND\_ROUTE}{IMONDROUTE}
    \configlabel{IMOND\_REBOOT}{IMONDREBOOT}
    \config{IMOND\_ENABLE  IMOND\_DIAL  IMOND\_ROUTE  IMOND\_REBOOT}{IMOND\_ENABLE}{IMONDENABLE}

    {Here, you can allow several commands from imonc clients to the imond
      to be executed in user mode.

      You can allow enabling/disabling the ISDN interface, dialling/hanging
      up, re-routing and/or rebooting the router.


      Default settings:

\begin{example}
\begin{verbatim}
        \var{IMOND\_\-ENABLE}='yes'
        \var{IMOND\_\-DIAL}='yes'
        \var{IMOND\_\-ROUTE}='yes'
        \var{IMOND\_\-REBOOT}='yes'
\end{verbatim}
\end{example}

      Additional features of the imond interface are described in section 9.}

  \end{description}

  \section{General circuit configuration}

  \begin{description}

    \config{IP\_DYN\_ADDR}{IP\_DYN\_ADDR}{IPDYNADDR}

    {If a connection with dynamic IP is used, \var{IP\_\-DYN\_\-ADDR} should
      be set to `yes', otherwise to `no'. Most providers use dynamic IP.

      Default setting: \var{IP\_\-DYN\_\-ADDR}='yes'}


    \config{DIALMODE}{DIALMODE}{DIALMODE}

    {fli4l uses `auto' as default dial mode, i.e. a connection established,
      as soon as someone tries to access a IP address that is not part of
      the LAN. Other values would be `manual' or `off'. In these cases,
      connecting can only be triggered using the imonc client.

      Default setting: DIALMODE='auto'}

  \end{description}

  \chapter{Packages}

  Meanwhile, you can choose from many different additional packages.
  Those are not contained in the rootfs-image, but are written (as archive
  opt.tgz) to the disk and are installed during the boot process from the
  ram disk. How this is done is described in src/README.

  Since version 2.0 a new modul concept is used. Besides the basis
  installation (base) there are packages. Those contain one or more OPT
  packages, that can be installied additionally to the base package.
  Some of these packages are contained within the basis packet, other come
  seperately. An overview of the packages supplied by the fli4l-Team can
  be found on the download page
  (\link{http://www.fli4l.de/german/download.php}). Packages from other
  authors can be found in the OPT database
  (\link{http://www.fli4l.de/german/extern/opt/}). Below, the packages
  supplied by the fli4l-Team are described.

  Not all packages will fit on the floppy disk at the same time. When using
  a standard fli4l configuration, there are approximately 400 KB compressed
  space on disk remaining, that can be used for additional packages.

  \section{programs in the basis package}

  In the base package you find the following programs:

  \begin{tabular}{lp{10cm}}
    Name     &       Description \\
    \hline    \hline
    \var{OPT\_\-SYSLOGD} &    \jump{OPTSYSLOGD}{program that logs system error messages} \\
    \var{OPT\_\-KLOGD}   &    \jump{OPTKLOGD}{program that logs kernel error messages} \\
    \var{OPT\_\-PORTFW}  &    \jump{OPTPORTFW}{tools for port forwarding} \\
    \var{OPT\_\-Y2K}     &    \jump{OPTY2K}{date correction when using a non-Y2K compliant PC} \\
    \var{OPT\_\-PNP}     &    \jump{OPTPNP}{install isapnp tools} \\
    \var{OPT\_INITTAB}   &    \jump{OPTINITTAB}{modify init configuration file} \\
  \end{tabular}


  \marklabel{OPTSYSLOGD}{\subsection{OPT\_SYSLOGD - program that logs system error messages}}

  Many programs use the syslog interface to display messages. To make them
  visible on the console, the demon syslogd has to be started.

  If you want debug messages, set \var{OPT\_\-SYSLOGD} to `yes',
  otherwise to `no'.

  See also \jump{ISDNCIRCxDEBUG}{ISDN\_CIRC\_x\_DEBUG} and
  \jump{PPPOEDEBUG}{PPPOE\_DEBUG}.


  Default setting: \var{OPT\_\-SYSLOGD}='no'


  \begin{description}
    \configlabel{SYSLOGD\_DEST\_x}{SYSLOGDDESTx}
    \config{SYSLOGD\_DEST\_N SYSLOGD\_DEST\_x}{SYSLOGD\_DEST\_N}{SYSLOGDDESTN}
  
  {Using \var{SYSLOGD\_\-DEST\_\-x} the targets are specified, where you
    want system messages written to the syslog interface to be displayed.
    Normally, this is the console of fli4l, i.e.

\begin{example}
\begin{verbatim}
        SYSLOGD_DEST_1='*.* /dev/console'
\end{verbatim}
\end{example}

  If you want to log to a file you will have to use something like this:

\begin{example}
\begin{verbatim}
        SYSLOGD_DEST_1='*.* /var/log/messages'
\end{verbatim}
\end{example}

  If a so called loghost is available in the LAN, you can redirect messages
  to this host - by specifying the IP address.

  Example:
\begin{example}
\begin{verbatim}
        SYSLOGD_DEST_1='*.* @192.168.4.1'
\end{verbatim}
\end{example}
  The @ sign has to be prepended.

  If the message should be ``delivered'' to multiple targets, the variable
  \var{SYSLOGD\_\-DEST\_\-N} (number of targets) has to be incremented
  correspondingly and the variables \var{SYSLOG\_\-DEST\_\-2},
  \var{SYSLOG\_\-DEST\_\-2} etc. have to be set.

  The parameter `*.*' means, that all messages should be logged.
  Alternatively, messages can be filtered for every destinations
  using so called ``priorities''. In this case the asterisk (*) behind
  the dot (.) has to be replaced by one of the following keywords:
  \begin{itemize}
  \item debug
  \item info
  \item notice
  \item warning (obsolete: warn)
  \item err (obsolete: error)
  \item crit
  \item alert
  \item emerg (obsolete: panic)
  \end{itemize}

  This list is ordered by the ``weight'' of the messages. The keywords
  error, warn and panic are obsolete and should not be used anymore.

  In front of the dot a so called ``facility'' instead of the asterisk (*)
  could be specified. An explanation would be too much for this document,
  so if you want to use it, try using any search engine. Normally, the
  asterisk is sufficient.

  Example:
  \begin{example}
\begin{verbatim}
          SYSLOGD_DEST_1='*.warning @192.168.4.1'
  \end{verbatim}
\end{example}

  Not only unix/linux hosts can act as loghost, but windows clients as well.
  On \link{http://www.fli4l.de} you will find the software required under
  ``Links''. Using a loghost is highly recommended if detailed logging is
  desired. Logging also helps in bug tracking. The windows client imonc is
  now also able understand the syslog protcol and can display the messages
  in a window.}

  \end{description}

  Unfortunately, boot messages cannot be redirected using syslogd.
  But you can configure fli4l, so that the console is a serial terminal
  (terminal emulation). How this can be done is described under
  (\jump{SERCONSOLE}{OPT\_Serial Console}).


  \marklabel{OPTKLOGD}{\subsection{OPT\_KLOGD - Kernel-Message-Logger}}

  Many of the errors - e.g. failed dial-in - are directly written to the
  console by the linux kernel. Using \var{OPT\_\-KLOGD}='yes' these messages
  are redirected to the syslogd, that can forward them to a loghost or write
  them to a file, see above. Then, the fli4l console will stay (almost)
  silent.

  Recommendation: If \var{OPT\_\-SYSLOGD}='yes' is set,
  \var{OPT\_\-KLOGD}='yes' should be set as well.

  Default setting: \var{OPT\_\-KLOGD}='no'


  \marklabel{OPTPORTFW}{\subsection{OPT\_PORTFW - Portforwarding }}

  For some internet protocols is it necessary to redirect a connection
  request of a remote host to the internal network. If the network is
  masqueraded for remote (IP masquerading), i.e. there is only one official
  IP available for the network, ports, that should be reachable from remote
  can be redirected to a certain internal host. This is called port
  forwarding (more general: Network Address Translation, NAT). How this can
  cause problems has already been discussed in the explanation of
  \var{MASQ\_\-MODULE\_\-N} (see above).

  Often, when using games, chat or internet telephony, such ports have to
  be opened. If the masquerading modules cannot handle these situations
  themselves, port-forwardings can be set up.

  \begin{description}
    \config{PORTFW\_N}{PORTFW\_N}{PORTFWN}

    {Here, the number of of port forwardings can be specified. Those are
      defined using \var{PORTFW\_\-x\_\-SOURCE}, \var{PORTFW\_\-x\_\-SOURCE}
      and \var{PORTFW\_\-x\_\-ROTOCOL}.}

    \config{PORTFW\_x\_SOURCE}{PORTFW\_x\_SOURCE}{PORTFWxSOURCE}

    { Packets are addressed to a specific target (normally a IP address
      and a port) and belong to a specific protocol. This target is
      the router in a masqueraded network, but the actual target is in
      the masqueraded network. The packets have to be forwarded to it.

      \var{PORTFW\_x\_SOURCE} specifies, what target the packets have to be
      addressed to to be forwarded. If such a packet arrives at the router,
      it is forwarded to the actual target.

      Here are the possible formats:

      {\tt \var{PORTFW\_\-x\_\-SOURCE}='<port>'}

      Forwards all packets, that arrive on port {\tt <port>} when an internet
      connection is active to another host.

      {\tt \var{PORTFW\_\-x\_\-SOURCE}='<port1>-<port2>'}

      Forwards all packets, that arrive on a port in the range between
      {\tt <port1>} and {\tt <port2>} to another host.

      {\tt \var{PORTFW\_\-x\_\-SOURCE}='<ip>:<port>'}

      Forwards all packet, that arrive on the IP {\tt <ip>} of the router on
      port {\tt <port>} to another host.

      {\tt \var{PORTFW\_\-x\_\-SOURCE}='<circuit>:<port>'}

      Forwards all packets, that arrive when the circuit {\tt <circuit>} is
      dialled on port {\tt <port>} to another host. {\tt <circuit>} is
      either the number of a ISDN circuit or ``pppoe'' for a DSL connection
      (see the package DSL).}

      {\tt \var{PORTFW\_\-x\_\-SOURCE}='none'}

      No limitation on the target. All packets, that arrive at the router and
      belong to the protocol specified in \var{PORTFW\_x\_PROTOCOL} are
      forwarded to another host.

    \config{PORTFW\_x\_TARGET}{PORTFW\_x\_TARGET}{PORTFWxTARGET}

    { This parameter specifies the target of a port forwarding. This is
      normally another host in the LAN.
      Following formats are possible:

      {\tt \var{PORTFW\_\-x\_\-TARGET}='<ip>'}

      Forwards all packets, that arrive for this rule to the host with
      the IP {\tt <ip>}.

      {\tt \var{PORTFW\_\-x\_\-TARGET}='<ip>:<port>'}

      Forwards all packets, that arrive for this rule to the host with
      the IP {\tt <ip>} to the port {\tt <port>}. This rule may not be
      used when \var{PORTFW\_x\_SOURCE} is a port range
      ({\tt <port1>-<port2>})! }

    \config{PORTFW\_x\_PROTOCOL}{PORTFW\_x\_PROTOCOL}{PORTFWxPROTOCOL}

    {\begin{sloppypar}
        This parameter specifies the protocol that matches this rule.
        Possible values are `tcp', `udp', `gre' or the specification
        of the protocol number (consult the list of port number of the
        IANA under \link{http://www.iana.org/assignments/protocol-numbers}.
    \end{sloppypar}}

    In earlier version you could place own rules in a special script.
    This is since version 2.1.0 NOT possible any more as this script
    would interfere with the variable-controlled port forwarding and
    a trouble-free function could not be guaranteed.

    You can find information on the port forwarding for special programs
    in the fli4l-portforwarding-FAQ and under:

    \link{http://www.tsmservices.com/masq/}

    On my homepage you can find a script that converts the rules you
    can find on this page to the fli4l-configuration format. You can
    also use it to convert the portforwarding-script from prior fli4l
    versions:

    \link{http://www.portfolio16.de/cgi-bin/portfw.pl}

    Using the windows client imonc it is possible to change the
    rules at run-time.

    \var{OPT\_\-PORTFW} is maintained by Tobias Gruetzmacher
    (\email{fli4l@portfolio16.de}). I will not support online games,
    filesharing-prgrams or other usage of the \var{OPT\_\-PORTFW}.

  \end{description}



  \marklabel{OPTY2K}{\subsection{OPT\_Y2K - date correction when using
      a non Y2K-compliant PC}}

  In most cases, fli4l router are assembled of old hardware. So the
  mainboard is not necessarily Y2K-compliant. My 486 computer has such
  a mainboard: When setting the date to 05/27/2000 in the BIOS, on the
  next boot it says 05/27/2094! Linux BTW, says, its 05/27/1994 :-)

  If your date it set correctly is not really important for a fli4l
  router and should not matter in most cases. But if it is used as least
  cost router, it does matter!
  The reason: 05/27/1994 was a friday, 05/27/2000 is a saturday -
  and on weekends there are cheaper rated or cheaper providers \ldots

  For fli4l this problem is solved this way:

  I set my BIOS date on 05/27/2000 to 05/28/1994. This was a saturday as
  well. So the problem was virtually solved.

  But the date was still wrong and fli4l uses not only the day and the
  time for LC routing but also public holidays.

  Y2K\_DAYS - add N days to the system date

  As the date I set differed exactly 2191 days to the actual date,
  setting

\begin{example}
\begin{verbatim}
        Y2K_DAYS='2191'
\end{verbatim}
\end{example}

  results in adding 2191 days to the BIOS' date and setting this date
  in linux. However, the BIOS' date is not changed. Otherwise the date
  would be reset to 2094 (or 1994) on the next boot ;-)

  There is another alternative:

  By accessing a time server, fli4l can fetch the correct date and time
  from the internet. Since version 1.4 there is a special package for this:
  OPT\_TIME. You can combine both settings, so the date is corrected using
  Y2K\_DAYS in any case and afterwards the exact time is fetched from the
  time server.

  If you do not have any Y2K related problems, set \var{OPT\_\-Y2K}='no'
  and just forget about it \ldots


  \marklabel{OPTPNP}{\subsection{OPT\_PNP - install isapnp tools}}

  Some ISDN-PnP-cards (ISA) have to be configured using the tool isapnp.
  Especilly \var{ISDN\_\-TYPE} 7, 12, 19, 24, 27 and 28 - but only if you
  really have an ISA-PnP-card.


  For configuration, it is necessary to create the configuration file
  etc/isapnp.conf.

  Here is a short description how to create it:

  \begin{itemize}
  \item In config/base.txt set the variables \var{OPT\_\-PNP}='yes' and
    \var{MOUNT\_\-BOOT}='rw'
  \item boot fli4l - the PnP-card will be not recognized most likely
  \item On the fli4l console type the following:
\begin{example}
\begin{verbatim}
        pnpdump -c >/boot/isapnp.conf
        umount /boot
\end{verbatim}
\end{example}
    Now the configuration has been saved to the floppy disk.
  \end{itemize}
  Continue on a PC (Unix/Linux/Windows):
  \begin{itemize}
  \item Copy the file isapnp.conf from the floppy to opt/etc/isapnp.conf
  \item Open isapnp.conf with your favourite editor
  \item Remember the values (IRQ/IO) and enter them in config/base.txt
  \item Create a new boot floppy
  \end{itemize}
  \achtung {The generated file is saved in UNIX format and does not contain
    CRs. If you open them under windows' notepad editor, it will show all the
    file in one line. The DOS editor ``edit'', however, can deal correctly
    with Unix files. The file will be saved as DOS file (containing CRs).}

  Workaround:
  \begin{itemize}
  \item Start a DOS box
  \item Change working directory to opt/etc (``cd <path to opt/etc>'')
  \item Type:
    edit isapnp.conf
  \item Edit file and save it
  \end{itemize}
  Then, you will be able to edit the file with notepad as well.

  The additionally generated CRs are filtered during the boot process of the
  fli4l, so they won't lead to problems.


  At first, you should try without \var{OPT\_\-PNP}. Only in case the card
  is not recognized, follow the procedure described above.

  When a new fli4l version is installed, the priorly created file isapnp.conf
  does not have to be recreated but can be used again.

  Default setting: \var{OPT\_\-PNP}='no'

  \marklabel{OPTINITTAB}{
    \subsection{OPT\_INITTAB - modify init configuration file}
  }

  Using this Opt you can let Init start additional programs on additional
  consoles or change the start commands of the init configuration file.
  An entry looks like this:

  \begin{example}
  \begin{verbatim}
    device option program
  \end{verbatim}
  \end{example}

  {\em device} specifies, to/from which device the program should read/write.
  Possible values are the standard terminals tty1-tty4 or the serial
  terminals ttyS0-ttySn where n is a value less than the number of the
  available serial interfaces.

  For {\em option}, {\em askfirst} or {\em respawn} are possible. When
  askfirst is specified, the command will be executed only after a key
  was pressed - respawn means, the program is automatically restarted
  if it terminates.

  The {\em program} is the program that you want to be executed. You have
  to specify the full path to the executable.

  Default setting for OPT\_INITTAB is: \var{OPT\_INITTAB}='no'

  \begin{description}
    \config{INITTAB\_N}{INITTAB\_N}{INITTABN}

    Specifies the number of additional entries in the Init config file.

    \config{INITTAB\_x}{INITTAB\_x}{INITTABx}

    Specifies the entries that are added to the config file.
  \end{description}

  It could look like the following:

  \begin{example}
  \begin{verbatim}
        OPT_INITTAB='yes'
        INITTAB_N='1'
        INITTAB_1='tty2 askfirst /usr/local/bin/mini-login'
  \end{verbatim}
  \end{example}

  Then you can login on the second terminal, also.
