In the last entry I talked about the ideathat an end node machine in a VPN actually has two distinct identitiesthat need to be routed separately: the inside identity that should berouted over the VPN, and the outside identity that should be routed overthe Internet. In this case each identity has an IP address associatedwith it; call the inside identity's IP address I and the outsideidentity's IP address O .

We can do this sort of routing with Linux's policy based routing, which

In the very old days you connected to Unix systems through serialterminals, which only had their getty processes started once init had finished processing /etc/rc .

In the old days you connected to Unix systems through rlogin(d),which was started through inetd , which was still started prettymuch at the end of system startup.

These days you connect to Unix systems through sshd , which is oftenstarted relatively early in the system boot sequence. This means thatyou can easily wind up logging into a machine that