<entry>PF is part of the base system.

	    <entry>PF is part of the base system.

	      Do <emphasis>not</emphasis> use the

	      Do <emphasis>not</emphasis> use the

	      <filename role="package">security/pf</filename> port

	      <filename role="package">security/pf</filename> port

	      Use the &man.pf.4; support of the base system instead.</entry>

	      Use the &man.pf.4; support of the base system instead.</entry>

	  </row>

	  </row>

	</tbody>

	</tbody>

            may be allowed in by the later authorized service rules.

            may be allowed in by the later authorized service rules.

            Second reason is that by having a rule that explicitly

            Second reason is that by having a rule that explicitly

            blocks selected packets that I receive on an infrequent

            blocks selected packets that I receive on an infrequent

            being caught by the last rule in the section which blocks

            being caught by the last rule in the section which blocks

            and logs all packets which have fallen through the rules.

            and logs all packets which have fallen through the rules.

            The last rule in the section which blocks and logs all

            The last rule in the section which blocks and logs all

       <replaceable>string</replaceable> is some text to search for.

       <replaceable>string</replaceable> is some text to search for.

       This searches port names, comments, descriptions and

       This searches port names, comments, descriptions and

       dependencies and can be used to find ports which relate to a

       dependencies and can be used to find ports which relate to a

       you are looking for.</para>

       you are looking for.</para>

      <para>In both of these cases, the search string is case-insensitive.

      <para>In both of these cases, the search string is case-insensitive.

      <para>Now it is time to start up the <acronym>KDC</acronym> services.

      <para>Now it is time to start up the <acronym>KDC</acronym> services.

	Run <command>/etc/rc.d/kerberos start</command> and

	Run <command>/etc/rc.d/kerberos start</command> and

	<command>/etc/rc.d/kadmind start</command> to bring up the

	<command>/etc/rc.d/kadmind start</command> to bring up the

	at this point but you should be able to confirm the that the

	at this point but you should be able to confirm the that the

	<acronym>KDC</acronym> is functioning by obtaining and listing a

	<acronym>KDC</acronym> is functioning by obtaining and listing a

	ticket for the principal (user) that you just created from the

	ticket for the principal (user) that you just created from the

	      and reverse) in <acronym>DNS</acronym> (or

	      and reverse) in <acronym>DNS</acronym> (or

	      <filename>/etc/hosts</filename> as a minimum).  CNAMEs

	      <filename>/etc/hosts</filename> as a minimum).  CNAMEs

	      will work, but the A and PTR records must be correct and in

	      will work, but the A and PTR records must be correct and in

	      <errorname>Kerberos5 refuses authentication because Read req

	      <errorname>Kerberos5 refuses authentication because Read req

	      failed: Key table entry not found</errorname>.</para>

	      failed: Key table entry not found</errorname>.</para>

	  </listitem>

	  </listitem>

        </listitem>

        </listitem>

        <listitem>

        <listitem>

          <para>The internal addresses of the two networks can be

          <para>The internal addresses of the two networks can be

            be running NAT on the gateway machine if necessary.</para>

            be running NAT on the gateway machine if necessary.</para>

        </listitem>

        </listitem>

        <listitem>

        <listitem>

        </listitem>

        </listitem>

        <listitem>

        <listitem>

          <para>There must be a mechanism for specifying which traffic

          <para>There must be a mechanism for specifying which traffic

            all your outgoing traffic -- you only want to encrypt the

            all your outgoing traffic -- you only want to encrypt the

            traffic that is part of the VPN.  The rules that you put in

            traffic that is part of the VPN.  The rules that you put in

            place to determine what traffic will be encrypted are called

            place to determine what traffic will be encrypted are called

         this to encrypt the traffic over the VPN.  They periodically

         this to encrypt the traffic over the VPN.  They periodically

         change this secret, so that even if an attacker were to crack one

         change this secret, so that even if an attacker were to crack one

         of the keys (which is as theoretically close to unfeasible as it

         of the keys (which is as theoretically close to unfeasible as it

         the key the two daemons have chosen another one.</para>

         the key the two daemons have chosen another one.</para>

       <para>racoon's configuration is stored in

       <para>racoon's configuration is stored in