From e6192d0bd34720a941025496a10b9ba1172cf932 Mon Sep 17 00:00:00 2001
From: teastep <teastep@fbd18981-670d-0410-9b5c-8dc0c1a9a2bb>
Date: Sat, 27 Aug 2005 21:47:09 +0000
Subject: [PATCH] Add 'openvpnclient' and 'openvpnserver' to the Open VPN doc

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2574 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
---
 Shorewall-docs2/OPENVPN.xml | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/Shorewall-docs2/OPENVPN.xml b/Shorewall-docs2/OPENVPN.xml
index 6013d9247..bded714e7 100644
--- a/Shorewall-docs2/OPENVPN.xml
+++ b/Shorewall-docs2/OPENVPN.xml
@@ -21,7 +21,7 @@
       </author>
     </authorgroup>
 
-    <pubdate>2005-02-08</pubdate>
+    <pubdate>2005-08-27</pubdate>
 
     <copyright>
       <year>2003</year>
@@ -254,6 +254,17 @@ road       tun+</programlisting>
 openvpn:1194  net            0.0.0.0/0</programlisting>
     </blockquote>
 
+    <para>If you are running Shorewall 2.4.3 or later, you might prefer the
+    following in <filename>/etc/shorewall/tunnels</filename> on system A.
+    Specifying the tunnel type as openvpnserver has the advantage that the VPN
+    connection will still work if the client is behind a gateway/firewall that
+    uses NAT.</para>
+
+    <blockquote>
+      <programlisting>#TYPE               ZONE           GATEWAY        GATEWAY ZONE
+openvpnserver:1194  net            0.0.0.0/0</programlisting>
+    </blockquote>
+
     <para>We want the remote systems to have access to the local LAN — we do
     that with an entry in <filename>/etc/shorewall/policy</filename> (assume
     that the local LAN comprises the zone <quote>loc</quote>).</para>
@@ -326,6 +337,15 @@ home       tun0</programlisting>
 openvpn:1194  net            206.162.148.9</programlisting>
     </blockquote>
 
+    <para>Again in you are running Shorewall 2.4.3 or later, in
+    <filename>/etc/shorewall/tunnels</filename> on system B you might
+    prefer:</para>
+
+    <blockquote>
+      <programlisting>#TYPE               ZONE           GATEWAY        GATEWAY ZONE
+openvpnclient:1194  net            206.162.148.9</programlisting>
+    </blockquote>
+
     <para>We want the remote clien to have access to the local LAN — we do
     that with an entry in <filename>/etc/shorewall/policy</filename>.</para>