1. TUN driver
=============

The TUN driver provides networking through the use of an IP tunnel. It is configured
by the line

netdev: tun0 -tun

The network topology will look similar to the following example:

-Ethernet----------------------------------------
| |
130.237.226.234 | 130.237.226.239
eth0 | other_machine
linux
tun0 |
192.168.41.1 |
| virtual
+--- ip-tunnel ------- mol
192.168.41.2

That is, the linux box typically has two configured network interfaces: eth0 and tun0.
The virtual tun network should use local IP addresses (these IP numbers have no meaning
to external hosts).

Unfortunately, mol can not connect to external hosts in the above setup (precisely
because external hosts do not know that the 192.168.1.2 address sits behind the
130.237.226.234 box).

The solution to this problem is NAT (network address translation, also called
IP-masquerading). In this case we want to make it appear as if packets sent from
MOL to an external host really originate from the linux box (an external host know
how to reach 130.237.226.234 and linux forwards packets to MOL whenever appropriate).

MOL normally configures NAT automatically from the /etc/mol/tunconfig script.
For reference, it basically does the following:

/sbin/iptables -t nat -s 192.168.41.0/24 -d ! 192.168.41.1
-A POSTROUTING -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward

The client side of the network is usually configured automatically by the built-in
DHCP server. It should look something like the following:

IP: 192.168.41.2
Netmask: 255.255.255.0
Gateway: 192.168.41.1
Nameserver: 192.168.41.1 (or whatever)

By defaul, MOL adds an alias NAT rule which redirects nameserver queries to
the linux host (192.168.41.1) to the first entry in /etc/resolv.conf.

#########################################################
# Configure interface
#########################################################

[ "$ACTION" = up ] && {
/sbin/ifconfig $TUN_DEV $TUN_HOST

# masquerade the tun network
$IPTABLES -t nat -A POSTROUTING -s $TUN_NET -d ! $TUN_NET -j MASQUERADE

# DNS redirection
[ "$DNS_REDIRECT" = yes ] && {
[ ! "$NAMESERVER" ] && {
NAMESERVER=`grep ^nameserver /etc/resolv.conf | awk -- '{ print $2 ; exit 0; }'`
[ ! "$NAMESERVER" ] && {
echo "Could not determine the nameserver (localhost is used)."
NAMESERVER=$TUN_HOST
}
}
echo "DHCP nameserver exported: $NAMESERVER"

$IPTABLES -t nat -N mol-ns-redirect 2> /dev/null
$IPTABLES -t nat -A mol-ns-redirect -j DNAT --to $NAMESERVER

# redirect tcp/udp port 53 (nameserver queries)
$IPTABLES -t nat -A PREROUTING -p tcp -i $TUN_DEV -d $TUN_HOST --dport 53 -j mol-ns-redirect
$IPTABLES -t nat -A PREROUTING -p udp -i $TUN_DEV -d $TUN_HOST --dport 53 -j mol-ns-redirect
}
}