+If you intend to configure secnet to obtain packets from the kernel
+using the universal TUN/TAP driver, make sure it's configured in your
+kernel (it's under "network device support" in Linux-2.4) and that
+you've created the appropriate device files; see
+linux/Documentation/networking/tuntap.txt
+
+If you're using TUN/TAP on a platform other than Linux-2.4, see
+http://vtun.sourceforge.net/tun/
+
+Note than TUN comes in two flavours, one (called 'tun' in the secnet
+config file) which has only one device file (usually /dev/net/tun) and
+the other (called 'tun-old') which has many device files (/dev/tun*).
+Linux-2.4 has new-style TUN, Linux-2.2, BSD and Solaris have old-style
+TUN.
+
+** System and network configuration
+
+If you intend to start secnet as root, I suggest you create a userid
+for it to run as once it's ready to drop its privileges. Example (on
+Debian):
+# adduser --system --no-create-home secnet
+
+If you're using the 'soft routes' feature (for some classes of mobile
+device) you'll have to run as root all the time, to enable secnet to
+add and remove routes from your kernel's routing table. (This
+restriction may be relaxed later if someone writes a userv service to
+modify the routing table.)
+
+If you are joining an existing VPN, read that VPN's documentation now.
+It may supersede the next paragraph.
+
+You will need to allocate two IP addresses for use by secnet. One
+will be for the tunnel interface on your tunnel endpoint machine (i.e.
+the address you see in 'ifconfig' when you look at the tunnel
+interface). The other will be for secnet itself. These addresses
+should probably be allocated from the range used by your internal
+network: if you do this, you should provide appropriate proxy-ARP on
+the internal network interface of the machine running secnet (eg. add
+an entry net/ipv4/conf/eth_whatever/proxy_arp = 1 to /etc/sysctl.conf
+on Debian systems and run sysctl -p). Alternatively the addresses
+could be from some other range - this works well if the machine
+running secnet is the default route out of your network - but this
+requires more thought.
+
+http://www.ucam.org/cam-grin/ may be useful.
+
+* Installation
+
+If you installed the Debian package of secnet, skip to "If installing
+for the first time", below, and note that example.conf can be found in
+/usr/share/doc/secnet/examples.
+
+To install secnet do