{
    my $policy = $DialupConnOffice;
    $OUT .= "\n";
    $OUT .= "#------------------------------------------------------------\n";
    $OUT .= "# Use \"$policy\" connect policy during office ";
    $OUT .= "hours on weekdays\n";
    $OUT .= "#------------------------------------------------------------\n";
    $OUT .= "\n";
    $OUT .= "restrict 8:00:00 17:59:59 1-5 * *\n";
    $OUT .= "\n";

    if ($policy eq 'continuous')
    {
	$OUT .= "up\n";
    }
    elsif ($policy eq 'never')
    {
	$OUT .= "down\n";
    }
    else
    {
	#--------------------------------------------------
        # "short" policy: HTTP transfers get 3 minutes,
	# everything else gets 30 seconds.
	#--------------------------------------------------

	my $httpHold  = 180;
	my $otherHold = 30;

	if ($policy eq 'medium')
	{
	    #--------------------------------------------------
	    # "medium" policy: HTTP transfers get 10 minutes,
	    # everything else gets 5 minutes.
	    #--------------------------------------------------

	    $httpHold  = 600;
	    $otherHold = 300;
	}
	elsif ($policy eq 'long')
	{
	    #--------------------------------------------------
	    # "long" policy: HTTP transfers get 20 minutes,
	    # everything else gets 10 minutes.
	    #--------------------------------------------------

	    $httpHold  = 1200;
	    $otherHold = 600;
	}

        #------------------------
        # Rules for TCP packets.
        #------------------------
        
	# If we force the line up (for example to trigger fetchmail)
	# but no packets are sent, specify how long to hold the line
	# up:

        $OUT .= "first-packet-timeout $otherHold\n";

        # The first rule is designed to give the link 30 seconds up time
        # when we are initiating a TCP connection.  The idea here is to deal
        # with possibility that the network on the opposite end of the
        # connection is unreachable.  In this case you don't really want to
        # give the link 10 minutes up time. With the rule below we only give
        # the link 30 seconds initially.  If the network is reachable then
        # we will normally get a response that actually contains some data
        # within 30 seconds.  If this causes problems because you have a
        # slow response time at some site you want to regularly access, you
        # can either increase the timeout or remove this rule.
        
        $OUT .= "accept tcp 30 tcp.syn\n";

        # If you are running named, then it will send data across the link
        # periodically to synchronize against other domain name servers.
        # Since this can happen at any time, it is undesirable to keep the
        # link up for it. Therefore, we ignore any tcp traffic from or to a
        # domain name server.
        
        $OUT .= "ignore tcp tcp.dest=tcp.domain\n";
        $OUT .= "ignore tcp tcp.source=tcp.domain\n";
        
        # Normally the packet that starts a connection is longer that 40
        # bytes, since it normally contains TCP options to specify the MSS.
        # However, some TCP implementations don't include these options.
        # Therefore, we must be careful not to ignore SYN packets that are
        # only 40 bytes long.

        $OUT .= "accept tcp 30 ip.tot_len=40,tcp.syn\n";

        # Otherwise, we want to ignore any TCP packet that is only 40 bytes
        # long, since it is not carrying any data. However, we don't want to
        # ignore 40 byte packets that mark the closing of a connection,
        # since we use those to cut short the timeout on connections that
        # have died.  Therefore we must test the tcp.live flag here. If it
        # is not set we might want to see this packet later on in the rules.

        $OUT .= "ignore tcp ip.tot_len=40,tcp.live\n";

        # Make sure http transfers hold the link up, even after they end.
        # This prevents web browsers from bouncing the connection too much.

        $OUT .= "accept tcp $httpHold tcp.dest=tcp.www\n";
        $OUT .= "accept tcp $httpHold tcp.source=tcp.www\n";

	if ($SquidParent)
	{
	    $OUT .= "accept tcp $httpHold tcp.dest=tcp.wwwproxy\n";
	    $OUT .= "accept tcp $httpHold tcp.source=tcp.wwwproxy\n";
	}

        # Once the link is no longer live, we try to shut down the
        # connection quickly. Note that if the link is already down, the
        # closing of the a connection (which will generate traffic) will not
        # bring it back up.
        
        $OUT .= "keepup tcp $otherHold !tcp.live\n";
        $OUT .= "ignore tcp !tcp.live\n";

        # Finally, if we don't match the TCP packet somewhere above, then we
        # give the link 10 minutes up time. Most TCP packets match this
        # rule. Note that as soon as the TCP connection is closed, the keepup
	# rule above overwrites the timeout.

        $OUT .= "accept tcp 600 any\n";
        
        #-----------------------
        # Rules for UDP packets
        #-----------------------
        
        # Don't bring the link up for rwho:
        
        $OUT .= "ignore udp udp.dest=udp.who\n";
        $OUT .= "ignore udp udp.source=udp.who\n";
        
        # Don't bring the link up for routing packets:
        
        $OUT .= "ignore udp udp.dest=udp.route\n";
        $OUT .= "ignore udp udp.source=udp.route\n";
        
        # Don't bring the link up for NTP or timed:
        
        $OUT .= "ignore udp udp.dest=udp.ntp\n";
        $OUT .= "ignore udp udp.source=udp.ntp\n";
        $OUT .= "ignore udp udp.dest=udp.timed\n";
        $OUT .= "ignore udp udp.source=udp.timed\n";
        
        # Don't bring up on domain name requests between 
	# two running copies of named:
        
        $OUT .= "ignore udp udp.dest=udp.domain,udp.source=udp.domain\n";
        
        # Bring up the network for domain requests:
        
        $OUT .= "accept udp 30 udp.dest=udp.domain \n";
        $OUT .= "accept udp 30 udp.source=udp.domain\n";
        
        # Bring up the network for netbios requests,
	# except between netbios servers:
        
        $OUT .=
	    "ignore udp udp.source=udp.netbios-ns,udp.dest=udp.netbios-ns\n";
        $OUT .= "accept udp 30 udp.dest=udp.netbios-ns\n";
        $OUT .= "accept udp 30 udp.source=udp.netbios-ns\n";
        
        # Any other UDP packets:
        
        $OUT .= "accept udp $otherHold any\n";
        
        # Catch any packets that we didn't catch above:
        
        $OUT .= "accept any $otherHold any\n";
    }
}