+@c ==================================================================
+@node Network interfaces, Example configuration, Generating keypairs, Configuration
+@section Network interfaces
+
+Before tinc can start transmitting data over the tunnel, it must
+set up the ethertap network devices.
+
+First, decide which IP addresses you want to have associated with these
+devices, and what network mask they must have.
+
+tinc will open an ethertap device or TUN/TAP device, which will also
+create a network interface called `tap0', or `tap1', and so on if you are using
+the ethertap driver, or a network interface with the same name as netname
+if you are using the universal TUN/TAP driver.
+
+@cindex tinc-up
+You can configure that device by putting ordinary ifconfig, route, and other commands
+to a script named @file{/etc/tinc/netname/tinc-up}. When tinc starts, this script
+will be executed. When tinc exits, it will execute the script named
+@file{/etc/tinc/netname/tinc-down}, but normally you don't need to create that script.
+
+An example @file{tinc-up} script when using the TUN/TAP driver:
+
+@example
+#!/bin/sh
+ifconfig $NETNAME hw ether fe:fd:00:00:00:00
+ifconfig $NETNAME @emph{xx}.@emph{xx}.@emph{xx}.@emph{xx} netmask @emph{mask}
+ifconfig $NETNAME -arp
+@end example
+
+@cindex MAC address
+@cindex hardware address
+The first line sets up the MAC address of the network interface.
+Due to the nature of how Ethernet and tinc work, it has to be set to fe:fd:00:00:00:00.
+(tinc versions prior to 1.0pre3 required that the MAC address matched the IP address.)
+You can use the environment variable $NETNAME to get the name of the interface.
+If you are using the ethertap driver however, you need to replace it with tap@emph{N},
+corresponding to the device file name.
+
+@cindex ifconfig
+The next line gives the interface an IP address and a netmask.
+The kernel will also automatically add a route to this interface, so normally you don't need
+to add route commands to the @file{tinc-up} script.
+The kernel will also bring the interface up after this command.
+@cindex netmask
+The netmask is the mask of the @emph{entire} VPN network, not just your
+own subnet.
+
+@cindex arp
+The last line tells the kernel not to use ARP on that interface.
+Again this has to do with how Ethernet and tinc work. Don't forget to add this line.