1.\" $OpenBSD: enc.4,v 1.22 2006/05/26 08:51:29 jmc Exp $ 2.\" 3.\" Copyright (c) 1999 Angelos D. Keromytis 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. All advertising materials mentioning features or use of this software 16.\" must display the following acknowledgement: 17.\" This product includes software developed by Angelos D. Keromytis. 18.\" 4. The name of the author may not be used to endorse or promote products 19.\" derived from this software without specific prior written permission. 20.\" 21.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31.\" 32.\" $FreeBSD$ 33.\" 34.Dd November 28, 2007 35.Dt ENC 4 36.Os 37.Sh NAME 38.Nm enc 39.Nd Encapsulating Interface 40.Sh SYNOPSIS 41To compile this driver into the kernel, 42place the following line in your 43kernel configuration file: 44.Bd -ragged -offset indent 45.Cd "device enc" 46.Ed 47.Sh DESCRIPTION 48The 49.Nm 50interface is a software loopback mechanism that allows hosts or 51firewalls to filter 52.Xr ipsec 4 53traffic using any firewall package that hooks in via the 54.Xr pfil 9 55framework. 56.Pp 57The 58.Nm 59interface allows an administrator to see incoming and outgoing packets 60before and after they will be or have been processed by 61.Xr ipsec 4 62via 63.Xr tcpdump 1 . 64.Pp 65The 66.Dq Li enc0 67interface inherits all IPsec traffic. 68Thus all IPsec traffic can be filtered based on 69.Dq Li enc0 , 70and all IPsec traffic could be seen by invoking 71.Xr tcpdump 1 72on the 73.Dq Li enc0 74interface. 75.Pp 76What can be seen with 77.Xr tcpdump 1 78and what will be passed on to the firewalls via the 79.Xr pfil 9 80framework can be independently controlled using the following 81.Xr sysctl 8 82variables: 83.Bl -column net.enc.out.ipsec_filter_mask 0x00000000 0x00000000 84.It Sy "Name Defaults Suggested" 85.It "net.enc.out.ipsec_bpf_mask 0x00000003 0x00000001" 86.It "net.enc.out.ipsec_filter_mask 0x00000001 0x00000001" 87.It "net.enc.in.ipsec_bpf_mask 0x00000001 0x00000002" 88.It "net.enc.in.ipsec_filter_mask 0x00000001 0x00000002" 89.El 90.Pp 91For the incoming path a value of 92.Li 0x1 93means 94.Dq Li before stripping off the outer header 95and 96.Li 0x2 97means 98.Dq Li after stripping off the outer header . 99For the outgoing path 100.Li 0x1 101means 102.Dq Li with only the inner header 103and 104.Li 0x2 105means 106.Dq Li with outer and inner headers . 107.Bd -literal 108incoming path |------| 109---- IPsec processing ---- (before) ---- (after) ----> | | 110 | Host | 111<--- IPsec processing ---- (after) ----- (before) ---- | | 112outgoing path |------| 113.Ed 114.Pp 115Most people will want to run with the suggested defaults for 116.Cm ipsec_filter_mask 117and rely on the security policy database for the outer headers. 118.Sh EXAMPLES 119To see the packets the processed via 120.Xr ipsec 4 , 121adjust the 122.Xr sysctl 8 123variables according to your need and run: 124.Pp 125.Dl "tcpdump -i enc0" 126.Sh SEE ALSO 127.Xr tcpdump 1 , 128.Xr bpf 4 , 129.Xr ipf 4 , 130.Xr ipfw 4 , 131.Xr ipsec 4 , 132.Xr pf 4 133