1bdea400fSAndrew Thompson.\" $OpenBSD: enc.4,v 1.22 2006/05/26 08:51:29 jmc Exp $ 2bdea400fSAndrew Thompson.\" 3bdea400fSAndrew Thompson.\" Copyright (c) 1999 Angelos D. Keromytis 4bdea400fSAndrew Thompson.\" All rights reserved. 5bdea400fSAndrew Thompson.\" 6bdea400fSAndrew Thompson.\" Redistribution and use in source and binary forms, with or without 7bdea400fSAndrew Thompson.\" modification, are permitted provided that the following conditions 8bdea400fSAndrew Thompson.\" are met: 9bdea400fSAndrew Thompson.\" 10bdea400fSAndrew Thompson.\" 1. Redistributions of source code must retain the above copyright 11bdea400fSAndrew Thompson.\" notice, this list of conditions and the following disclaimer. 12bdea400fSAndrew Thompson.\" 2. Redistributions in binary form must reproduce the above copyright 13bdea400fSAndrew Thompson.\" notice, this list of conditions and the following disclaimer in the 14bdea400fSAndrew Thompson.\" documentation and/or other materials provided with the distribution. 15bdea400fSAndrew Thompson.\" 3. All advertising materials mentioning features or use of this software 16bdea400fSAndrew Thompson.\" must display the following acknowledgement: 17bdea400fSAndrew Thompson.\" This product includes software developed by Angelos D. Keromytis. 18bdea400fSAndrew Thompson.\" 4. The name of the author may not be used to endorse or promote products 19bdea400fSAndrew Thompson.\" derived from this software without specific prior written permission. 20bdea400fSAndrew Thompson.\" 21bdea400fSAndrew Thompson.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22bdea400fSAndrew Thompson.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23bdea400fSAndrew Thompson.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24bdea400fSAndrew Thompson.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25bdea400fSAndrew Thompson.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26bdea400fSAndrew Thompson.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27bdea400fSAndrew Thompson.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28bdea400fSAndrew Thompson.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29bdea400fSAndrew Thompson.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30bdea400fSAndrew Thompson.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31bdea400fSAndrew Thompson.\" 32bdea400fSAndrew Thompson.\" $FreeBSD$ 33bdea400fSAndrew Thompson.\" 34e0c92631SBjoern A. Zeeb.Dd August 1, 2007 35bdea400fSAndrew Thompson.Dt ENC 4 36bdea400fSAndrew Thompson.Os 37bdea400fSAndrew Thompson.Sh NAME 38bdea400fSAndrew Thompson.Nm enc 39bdea400fSAndrew Thompson.Nd Encapsulating Interface 40bdea400fSAndrew Thompson.Sh SYNOPSIS 41904887e2SChristian BruefferTo compile this driver into the kernel, 42904887e2SChristian Bruefferplace the following line in your 43904887e2SChristian Bruefferkernel configuration file: 44904887e2SChristian Brueffer.Bd -ragged -offset indent 45bdea400fSAndrew Thompson.Cd "device enc" 46904887e2SChristian Brueffer.Ed 47bdea400fSAndrew Thompson.Sh DESCRIPTION 48bdea400fSAndrew ThompsonThe 49bdea400fSAndrew Thompson.Nm 50bdea400fSAndrew Thompsoninterface is a software loopback mechanism that allows hosts or 51bdea400fSAndrew Thompsonfirewalls to filter 52e0c92631SBjoern A. Zeeb.Xr ipsec 4 53bdea400fSAndrew Thompsontraffic using any firewall package that hooks in via the 54bdea400fSAndrew Thompson.Xr pfil 9 55bdea400fSAndrew Thompsonframework. 56bdea400fSAndrew Thompson.Pp 57bdea400fSAndrew ThompsonThe 58bdea400fSAndrew Thompson.Nm 59bdea400fSAndrew Thompsoninterface allows an administrator 60bdea400fSAndrew Thompsonto see outgoing packets before they have been processed by 61e0c92631SBjoern A. Zeeb.Xr ipsec 4 , 62bdea400fSAndrew Thompsonor incoming packets after they have been similarly processed, via 63e0ca5a93SChristian Brueffer.Xr tcpdump 1 . 64bdea400fSAndrew Thompson.Pp 65bdea400fSAndrew ThompsonThe 66ae91966bSRuslan Ermilov.Dq Li enc0 67bdea400fSAndrew Thompsoninterface inherits all IPsec traffic. 68bdea400fSAndrew ThompsonThus all IPsec traffic can be filtered based on 69ae91966bSRuslan Ermilov.Dq Li enc0 , 70bdea400fSAndrew Thompsonand all IPsec traffic could be seen by invoking 71e0ca5a93SChristian Brueffer.Xr tcpdump 1 72bdea400fSAndrew Thompsonon the 73ae91966bSRuslan Ermilov.Dq Li enc0 74bdea400fSAndrew Thompsoninterface. 75bdea400fSAndrew Thompson.Sh EXAMPLES 76bdea400fSAndrew ThompsonTo see all outgoing packets before they have been processed via 77e0c92631SBjoern A. Zeeb.Xr ipsec 4 , 78bdea400fSAndrew Thompsonor all incoming packets after they have been similarly processed: 79bdea400fSAndrew Thompson.Pp 80ae91966bSRuslan Ermilov.Dl "tcpdump -i enc0" 81bdea400fSAndrew Thompson.Sh SEE ALSO 82904887e2SChristian Brueffer.Xr tcpdump 1 , 83bdea400fSAndrew Thompson.Xr bpf 4 , 84bdea400fSAndrew Thompson.Xr ipf 4 , 85bdea400fSAndrew Thompson.Xr ipfw 4 , 86e0c92631SBjoern A. Zeeb.Xr ipsec 4 , 87e0c92631SBjoern A. Zeeb.Xr pf 4 , 88e0c92631SBjoern A. Zeeb.Xr tcpdump 8 89