diff --git a/docs/VPN.xml b/docs/VPN.xml
index 55c1605bb..17d0df65a 100644
--- a/docs/VPN.xml
+++ b/docs/VPN.xml
@@ -135,7 +135,63 @@
The above may or may not work — your milage may vary. NAT Traversal
- is definitely a better solution.
+ is definitely a better solution. To use NAT traversal:
+ /etc/shorewall/rules with NAT Traversal
+
+
+
+
+ ACTION
+
+ SOURCE
+
+ DESTINATION
+
+ PROTOCOL
+
+ PORT
+
+ CLIENT PORT
+
+ ORIGINAL DEST
+
+
+
+
+
+ DNAT
+
+ net:192.0.2.224
+
+ loc:192.168.1.12
+
+ udp
+
+ 4500
+
+
+
+
+
+
+
+ DNAT
+
+ net:192.0.2.224
+
+ loc:192.168.1.12
+
+ udp
+
+ 500
+
+
+
+
+
+
+
+
If you want to be able to give access to all of your local systems
to the remote network, you should consider running a VPN client on your