In the last entry I talked about the ideathat an end node machine in a VPN actually has two distinct identitiesthat need to be routed separately: the inside identity that should berouted over the VPN, and the outside identity that should be routed overthe Internet. In this case each identity has an IP address associatedwith it; call the inside identity's IP address I and the outsideidentity's IP address O .

We can do this sort of routing with Linux's policy based routing, which

In the very old days you connected to Unix systems through serialterminals, which only had their getty processes started once init had finished processing /etc/rc .

In the old days you connected to Unix systems through rlogin(d),which was started through inetd , which was still started prettymuch at the end of system startup.

These days you connect to Unix systems through sshd , which is oftenstarted relatively early in the system boot sequence. This means thatyou can easily wind up logging into a machine that

The basic operation of iSCSI goes something like this:

1. poke things to discover what iSCSI targets you have available, then
2. login to each target, creating sessions and discovering whatiSCSI devices (eg, disks) they have available, then
3. talk to those iSCSI devices over the sessions you've createdto actually do things.

There are three sorts of discovery: static configuration, SendTarget,and iSNS. Static configuration is the least convenient, because itrequires you to know the target's full iSCSI name as well as its

An end node machine connecting in through a VPN has two IP addresses;one IP address that is inside the VPN (call it I), and its normal IPaddress outside the VPN (call it O). The outside address is sometimescalled the wild side address, because it is accessibly by the wildInternet.

A lot of writing about VPNs assumes that I and O are disjoint from eachother, effectively on completely isolated networks; I talks to thecorporate network behind the VPN and only the corporate network,