comment out references to ipf to be replaced in the future with whatever packet filter we end up using

1 files changed, 53 insertions, 52 deletions

diff --git a/share/man/man8/vpn.8 b/share/man/man8/vpn.8
index 9459e67b6ac..8f0c059b325 100644
--- a/share/man/man8/vpn.8
+++ b/share/man/man8/vpn.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: vpn.8,v 1.50 2001/03/01 16:11:24 aaron Exp $
+.\" $OpenBSD: vpn.8,v 1.51 2001/05/30 03:24:17 millert Exp $
 .\"
 .\" Copyright 1998 Niels Provos <provos@physnet.uni-hamburg.de>
 .\" All rights reserved.
@@ -262,54 +262,55 @@ authentication) start the daemon with debugging or verbose output.
 implements security policy using the
 .Em KeyNote
 trust management system.
-.Ss Configuring Firewall Rules
-.Xr ipf 8
-needs to be configured such that all packets from the outside are blocked
-by default.
-Only successfully IPsec-processed packets (from the
-.Xr enc 4
-interface), or key management packets (for
-.Xr photurisd 8 ,
-.Tn UDP
-packets with source and destination ports of 468, and for
-.Xr isakmpd 8 ,
-.Tn UDP
-packets with source and destination ports of 500) should be allowed to pass.
-.Pp
-The
-.Xr ipf 5
-rules for a tunnel which uses encryption (the ESP IPsec protocol) and
+.\"XXX - replace with ipfw when it is in-tree
+.\".Ss Configuring Firewall Rules
+.\".Xr ipf 8
+.\"needs to be configured such that all packets from the outside are blocked
+.\"by default.
+.\"Only successfully IPsec-processed packets (from the
+.\".Xr enc 4
+.\"interface), or key management packets (for
+.\".Xr photurisd 8 ,
+.\".Tn UDP
+.\"packets with source and destination ports of 468, and for
+.\".Xr isakmpd 8 ,
+.\".Tn UDP
+.\"packets with source and destination ports of 500) should be allowed to pass.
+.\".Pp
+.\"The
+.\".Xr ipf 5
+.\"rules for a tunnel which uses encryption (the ESP IPsec protocol) and
 .Xr photurisd 8
-on security gateway A might look like this:
-.Bd -literal
-# ne0 is the only interface going to the outside.
-block in log on ne0 from any to any
-block out log on ne0 from any to any
-block in log on enc0 from any to any
-block out log on enc0 from any to any
-
-# Passing in encrypted traffic from security gateways
-pass in proto esp from gatewB/32 to gatewA/32
-pass out proto esp from gatewA/32 to gatewB/32
-
-# Passing in traffic from the designated subnets.
-pass in on enc0 from netB/netBmask to netA/netAmask
-pass out on enc0 from natA/netAmask to netB/netBmask
-
-# Passing in Photuris traffic from the security gateways
-pass in on ne0 proto udp from gatewB/32 port = 468 to gatewA/32 port = 468
-pass out on ne0 proto udp from gatewA/32 port = 468 to gatewB/32 port = 468
-.Ed
-.Pp
-If there are no other
-.Xr ipf 5
-rules, the "quick" clause can be added to the last four rules.
-NAT rules can also be used on the
-.Xr enc 4
-interface.
-Note that it is strongly encouraged that instead of detailed IPF
-rules, the SPD (IPsec flow database) be utilized to specify security
-policy, if only to avoid filtering conflicts.
+.\"on security gateway A might look like this:
+.\".Bd -literal
+.\"# ne0 is the only interface going to the outside.
+.\"block in log on ne0 from any to any
+.\"block out log on ne0 from any to any
+.\"block in log on enc0 from any to any
+.\"block out log on enc0 from any to any
+.\"
+.\"# Passing in encrypted traffic from security gateways
+.\"pass in proto esp from gatewB/32 to gatewA/32
+.\"pass out proto esp from gatewA/32 to gatewB/32
+.\"
+.\"# Passing in traffic from the designated subnets.
+.\"pass in on enc0 from netB/netBmask to netA/netAmask
+.\"pass out on enc0 from natA/netAmask to netB/netBmask
+.\"
+.\"# Passing in Photuris traffic from the security gateways
+.\"pass in on ne0 proto udp from gatewB/32 port = 468 to gatewA/32 port = 468
+.\"pass out on ne0 proto udp from gatewA/32 port = 468 to gatewB/32 port = 468
+.\".Ed
+.\".Pp
+.\"If there are no other
+.\".Xr ipf 5
+.\"rules, the "quick" clause can be added to the last four rules.
+.\"NAT rules can also be used on the
+.\".Xr enc 4
+.\"interface.
+.\"Note that it is strongly encouraged that instead of detailed IPF
+.\"rules, the SPD (IPsec flow database) be utilized to specify security
+.\"policy, if only to avoid filtering conflicts.
 .Sh EXAMPLES
 .Ss Manual keying
 To create a manual keyed VPN between two class C networks using
@@ -681,8 +682,8 @@ Sample VPN configuration file
 configuration file
 .It Pa /etc/photuris/photuris.conf
 Photuris configuration file
-.It Pa /etc/ipf.rules
-Firewall configuration file
+.\".It Pa /etc/ipf.rules
+.\"Firewall configuration file
 .El
 .Sh BUGS
 .Xr photurisd 8
@@ -696,8 +697,8 @@ or manual keying must be used.
 .Xr enc 4 ,
 .Xr ipsec 4 ,
 .Xr options 4 ,
-.Xr ipf 5 ,
-.Xr ipf 8 ,
+.\".Xr ipf 5 ,
+.\".Xr ipf 8 ,
 .Xr ipsecadm 8 ,
 .Xr sysctl 8 ,
 .Xr openssl 1 ,