I want to bring more attention to this feature. As you may know I'm stuck on lowly dialup that only costs me $6.95/month. One of the great benefits of dialup is that I get disconnected periodically. This wouldn't be worth blogging about if there wasn't something bugging me. What's bothering me is that Linux DOES NOT disconnect those sockets, while Windows does.
Since Windows is the pearl here, I'll describe what it does. Say I have Psi and Thunderbird open, and I get disconnected. Windows immediately tells them that their sockets are toast, and the application will try to reconnect since it lost the connection.
Under Linux this doesn't happen. I get disconnected, and I have to wait for the sockets to TIMEOUT. So I end up with Psi spewing things into a blackhole, and Thunderbird flat out screws up and can barely function.
A long while back I made a post about this to the Linux PPP mailing list. The reason that was laid out is that sockets and the devices are in seperate layers so a socket doesn't know what device it is on. That's nice if you have an ethernet cable powering a static IP, and you like to unplug it just for shits. It's not so nice when you're on a dynamic IP and well, those connections just don't make any sense anymore.
To fix this Linux needs to tell the socket layer "Hey, this IP we just had for this device is toast. Close on up." Is this so hard to ask before I turn into a kernel hacker which I don't want to make my cup of tea at the moment?
use masquerade
Are you using MAQUERADE or regular SNAT? From the iptables manpage:
MASQUERADE
This target is only valid in the nat table, in the POSTROUTING chain.
It should only be used with dynamically assigned IP (dialup) connec-
tions: if you have a static IP address, you should use the SNAT target.
Masquerading is equivalent to specifying a mapping to the IP address of
the interface the packet is going out, but also has the effect that
connections are forgotten when the interface goes down. This is the
correct behavior when the next dialup is unlikely to have the same
interface address (and hence any established connections are lost any-
way).
If memory serves MASQUERADE works just as advertised. Of course it could've been broken in more recent versions of netfilter and/or the kernel. I haven't tried it with 2.6 yet, for example.