add sample ipf configuration

1 files changed, 24 insertions, 4 deletions

diff --git a/share/man/man8/vpn.8 b/share/man/man8/vpn.8
index c2a45a407b8..4d1e61ff6a8 100644
--- a/share/man/man8/vpn.8
+++ b/share/man/man8/vpn.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: vpn.8,v 1.2 1998/05/24 23:26:42 provos Exp $
+.\" $OpenBSD: vpn.8,v 1.3 1998/06/02 09:18:33 provos Exp $
 .\" Copyright 1998 Niels Provos <provos@physnet.uni-hamburg.de>
 .\" All rights reserved.
 .\"
@@ -78,11 +78,31 @@ interface or
 .Tn UDP
 packets with source and remote ports of 468
 should be allowed in.
+.Pp 
+The ipf rules for a tunnel which only uses ESP on security gateway A 
+might look like this:
+.Bd -literal
+# ed0 is the only interface going to the outside.
+block in log on ed0 from any to any
+block out log on ed0 from any to any
+block in log on enc0 from any to any
+
+# Passing in encrypted traffic from security gateways
+pass in proto sipp-esp from gatewB to gatewA
+pass out proto sipp-esp from gatewA to gatewB
+
+# Passing in traffic from the designated subnets.
+pass in on enc0 from netB/netBmask to netA/netAmask
+
+# Passing in Photuris traffic from the security gateways
+pass in on ed0 proto udp from gatewB/32 port = 468 to gatewA/32 port = 468
+pass out on ed0 proto udp from gatewA/32 port = 468 to gatewB/32 port = 468
+.Ed
+.Pp
+If there are no more ipf rules the quick clause can be added to the last
+three rules.
 .Sh SEE ALSO
 .Xr ipf 1 ,
 .Xr ipsecadm 1 ,
 .Xr ipsec 4 ,
 .Xr photurisd 8 .
-.Sh HISTORY
-VPN support appeared first in
-.Ox 2.3 .