-This version of tinc supports multiple virtual networks at once. To
-use this feature, you may supply a netname via the -n or --net
-options. The standard locations for the config files will then be
-/etc/tinc/<net>/. Because of this feature, tinc will send packets
-directly to their destinations, instead of to the uplink. If this
-behaviour is undesirable (for instance because of firewalls or
-other restrictions), please use an older version of tinc (I would
-recommend tinc-0.2.19).
-
-In this version, MAC addresses are stripped off before encoding and
-sending a packet. When the packet reaches its destination, the MAC
-addresses are rebuilt again. They then have the form
-FE:FD:aa:bb:cc:dd. aa, bb, cc and dd are taken from the destination
-and source IP address. See the manual for more detailed information.
-
-tincd regenerates its encryption key pairs. It does this on the first
-activity after the keys have expired. This period is adjustable in the
-configuration file, and the default time is 3600 seconds (one
-hour). If you send a USR2 signal to the daemon, it'll regenerate
-immediately.
+This version of tinc supports multiple virtual networks at once. To use this
+feature, you may supply a netname via the -n or --net options. The standard
+locations for the config files will then be /etc/tinc/<net>/. Because of this
+feature, tinc will send packets directly to their destinations, instead of to
+the uplink. If this behaviour is undesirable (for instance because of firewalls
+or other restrictions), please use an older version of tinc (I would recommend
+tinc-0.2.19).
+
+In order to force the kernel to accept received packets, the destination MAC
+address will be set to FE:FD:00:00:00:00 upon reception. The MAC address of the
+ethertap or tun/tap interface must also be set to this address. See the manual
+for more detailed information.
+
+tincd regenerates its encryption key pairs. It does this on the first activity
+after the keys have expired. This period is adjustable in the configuration
+file, and the default time is 3600 seconds (one hour).
+
+This version supports multiple subnets at once. They are also sorted on subnet
+mask size. This means that it is possible to have overlapping subnets on the
+VPN, as long as their subnet mask sizes differ.