+@c ==================================================================
+@node Host configuration variables, How to configure, Main configuration variables, Configuration file
+@subsection Host configuration variables
+
+@table @asis
+@item @strong{Address = <IP address|hostname>}
+This variable is only required if you want to connect to this host. It
+must resolve to the external IP address where the host can be reached,
+not the one that is internal to the VPN.
+
+@item IndirectData = <yes|no> (no, experimental)
+This option specifies whether other tinc daemons besides the one you
+specified with ConnectTo can make a direct connection to you. This is
+especially useful if you are behind a firewall and it is impossible to
+make a connection from the outside to your tinc daemon. Otherwise, it
+is best to leave this option out or set it to no.
+
+@item Port = <port> (655)
+Connect to the upstream host (given with the ConnectTo directive) on
+port port. port may be given in decimal (default), octal (when preceded
+by a single zero) o hexadecimal (prefixed with 0x). port is the port
+number for both the UDP and the TCP (meta) connections.
+
+@item PublicKey = <key> (obsolete)
+This is the RSA public key for this host.
+
+@item PublicKeyFile = <path> (obsolete)
+This is the full path name of the RSA public key file that was generated
+by ``tincd --generate-keys''. It must be a full path, not a relative
+directory.
+
+From version 1.0pre4 on tinc will store the public key directly into the
+host configuration file in PEM format, the above two options then are not
+necessary. Either the PEM format is used, or exactly
+@strong{one of the above two options} must be specified
+in each host configuration file, if you want to be able to establish a
+connection with that host.
+
+@item Subnet = <IP address/maskbits>
+This is the subnet range of all IP addresses that will be accepted by
+the host that defines it.
+
+The range must be contained in the IP address range of the tap device,
+not the real IP address of the host running tincd.
+
+maskbits is the number of bits set to 1 in the netmask part; for
+example: netmask 255.255.255.0 would become /24, 255.255.252.0 becomes
+/22. This conforms to standard CIDR notation as described in
+@uref{ftp://ftp.isi.edu/in-notes/rfc1519.txt, RFC1519}
+
+@item TCPonly = <yes|no> (no, experimental)
+If this variable is set to yes, then the packets are tunnelled over a
+TCP connection instead of a UDP connection. This is especially useful
+for those who want to run a tinc daemon from behind a masquerading
+firewall, or if UDP packet routing is disabled somehow. This is
+experimental code, try this at your own risk. It may not work at all.