The way that I run dial-on-demand ppp it appears from the clients to be a permanent connection. The ppp daemon takes care of dialing when someone needs a connection and dropping the line when it is not busy, but this is transparent to the machines that use the gateway.

The distinction I was attempting to draw was that my firewall rules only masquerades the current "valid" systems to the outside world (which ones are valid is controlled by a Perl script naturally).