  <varlistentry>
  <term><emphasis remap='B'>disablearrivalcheck</emphasis></term>
  <listitem>
<para>whether KLIPS's normal tunnel-exit check
(that a packet emerging from a tunnel has plausible addresses in its header)
should be disabled;
acceptable values are
<emphasis remap='B'>yes</emphasis>
and
<emphasis remap='B'>no</emphasis>
(the default).
Tunnel-exit checks improve security and do not break any normal configuration.
Relevant only locally, other end need not agree on it.</para>
  </listitem>
  </varlistentry>
