conn clear
	type=passthrough
	authby=never
	left=%defaultroute
	right=%group
	auto=ondemand

conn clear-or-private
	type=tunnel
	left=%defaultroute
	authby=rsasig
	leftid=%fromcert
	rightid=%fromcert
	leftcert=signedbyother
	right=%opportunisticgroup
	failureshunt=passthrough
	negotiationshunt=passthrough
	auto=add

conn private-or-clear
	type=tunnel
	left=%defaultroute
	authby=rsasig
	leftid=%fromcert
	rightid=%fromcert
	leftcert=signedbyother
	right=%opportunisticgroup
	failureshunt=passthrough
	negotiationshunt=passthrough
	auto=ondemand

conn private
	type=tunnel
	left=%defaultroute
	authby=rsasig
	leftid=%fromcert
	rightid=%fromcert
	leftcert=signedbyother
	right=%opportunisticgroup
	negotiationshunt=hold
	failureshunt=drop
	auto=ondemand

conn block
	type=reject
	authby=never
	left=%defaultroute
	right=%group
	auto=ondemand