  <varlistentry>
  <term><emphasis remap='B'>leftprotoport</emphasis></term>
  <listitem>
<para>allowed protocols and ports over connection, also called Port
Selectors. The argument is in the form <emphasis remap='I'>protocol</emphasis>,
which can be a number or a name that will be looked up in
<emphasis remap='I'>/etc/protocols</emphasis>, such as
<emphasis remap='I'>leftprotoport=icmp</emphasis>, or in the form of
<emphasis remap='I'>protocol/port</emphasis>, such as
<emphasis remap='I'>tcp/smtp</emphasis>. Ports can be defined as a number (eg. 25)
or as a name (eg smtp) which will be looked up in
<emphasis remap='I'>/etc/services</emphasis>. A special keyword
<emphasis remap='I'>%any</emphasis> can be used to allow all ports of a certain
protocol. The most common use of this option is for L2TP connections to only
allow l2tp packets (UDP port 1701), eg:
<emphasis remap='I'>leftprotoport=17/1701</emphasis>.</para>

<para> To filter on specific icmp type and code, use the higher 8 bits for type
and the lower 8 bits for port. For example, to allow icmp echo packets (type 8,
code 0) the 'port' would be 0x0800, or 2048 in decimal, so you configure
<emphasis remap='I'>leftprotoport=icmp/2048</emphasis>. Similarly, to allow ipv6-icmp
Neighbour Discovery which has type 136 (0x88) and code 0(0x00) this becomes 0x8800
or in decimal 34816 resulting in <emphasis remap='I'>leftprotoport=ipv6-icmp/34816</emphasis> . </para>

<para>Some clients, notably
older Windows XP and some Mac OSX clients, use a random high port as source
port. In those cases <emphasis remap='I'>rightprotoport=17/%any</emphasis> can
be used to allow all UDP traffic on the connection.
Note that this option is part of the proposal, so it cannot be arbitrarily left out
if one end does not care about the traffic selection over this connection - both peers have
to agree. The Port Selectors show up in the output of
<emphasis remap='I'>ipsec eroute</emphasis> and <emphasis remap='I'>ipsec auto --status</emphasis>
eg:<emphasis remap='I'>"l2tp": 193.110.157.131[@aivd.libreswan.org]:7/1701...%any:17/1701</emphasis>
This option only filters outbound traffic.  Inbound traffic selection
must still be based on firewall rules activated by an updown script. The
variables $PLUTO_MY_PROTOCOL, $PLUTO_PEER_PROTOCOL, $PLUTO_MY_PORT, and
$PLUTO_PEER_PORT are available for use in <emphasis remap='I'>updown</emphasis>
scripts. Older workarounds for bugs involved a setting of <emphasis remap='I'>17/0</emphasis>
to denote <emphasis remap='I'>any single UDP port</emphasis> (not UDP port 0). Some clients, most notably OSX, uses a random high port, instead of port 1701 for L2TP.
</para>
  </listitem>
  </varlistentry>
