1*fcf59617SAndrey V. Elsukov.\" Copyright (c) 2017 Andrey V. Elsukov <ae@FreeBSD.org> 2*fcf59617SAndrey V. Elsukov.\" All rights reserved. 3*fcf59617SAndrey V. Elsukov.\" 4*fcf59617SAndrey V. Elsukov.\" Redistribution and use in source and binary forms, with or without 5*fcf59617SAndrey V. Elsukov.\" modification, are permitted provided that the following conditions 6*fcf59617SAndrey V. Elsukov.\" are met: 7*fcf59617SAndrey V. Elsukov.\" 1. Redistributions of source code must retain the above copyright 8*fcf59617SAndrey V. Elsukov.\" notice, this list of conditions and the following disclaimer. 9*fcf59617SAndrey V. Elsukov.\" 2. Redistributions in binary form must reproduce the above copyright 10*fcf59617SAndrey V. Elsukov.\" notice, this list of conditions and the following disclaimer in the 11*fcf59617SAndrey V. Elsukov.\" documentation and/or other materials provided with the distribution. 12*fcf59617SAndrey V. Elsukov.\" 13*fcf59617SAndrey V. Elsukov.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 14*fcf59617SAndrey V. Elsukov.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15*fcf59617SAndrey V. Elsukov.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16*fcf59617SAndrey V. Elsukov.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 17*fcf59617SAndrey V. Elsukov.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18*fcf59617SAndrey V. Elsukov.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19*fcf59617SAndrey V. Elsukov.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20*fcf59617SAndrey V. Elsukov.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21*fcf59617SAndrey V. Elsukov.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22*fcf59617SAndrey V. Elsukov.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23*fcf59617SAndrey V. Elsukov.\" SUCH DAMAGE. 24*fcf59617SAndrey V. Elsukov.\" 25*fcf59617SAndrey V. Elsukov.Dd February 6, 2017 26*fcf59617SAndrey V. Elsukov.Dt if_ipsec 4 27*fcf59617SAndrey V. Elsukov.Os 28*fcf59617SAndrey V. Elsukov.Sh NAME 29*fcf59617SAndrey V. Elsukov.Nm if_ipsec 30*fcf59617SAndrey V. Elsukov.Nd IPsec virtual tunneling interface 31*fcf59617SAndrey V. Elsukov.Sh SYNOPSIS 32*fcf59617SAndrey V. ElsukovThe 33*fcf59617SAndrey V. Elsukov.Cm if_ipsec 34*fcf59617SAndrey V. Elsukovnetwork interface is a part of the 35*fcf59617SAndrey V. Elsukov.Fx 36*fcf59617SAndrey V. ElsukovIPsec implementation. 37*fcf59617SAndrey V. ElsukovTo compile it into the kernel, place this line in the kernel 38*fcf59617SAndrey V. Elsukovconfiguration file: 39*fcf59617SAndrey V. Elsukov.Bd -ragged -offset indent 40*fcf59617SAndrey V. Elsukov.Cd "options IPSEC" 41*fcf59617SAndrey V. Elsukov.Ed 42*fcf59617SAndrey V. Elsukov.Pp 43*fcf59617SAndrey V. ElsukovIt can also be loaded as part of the 44*fcf59617SAndrey V. Elsukov.Cm ipsec 45*fcf59617SAndrey V. Elsukovkernel module if the kernel was compiled with 46*fcf59617SAndrey V. Elsukov.Bd -ragged -offset indent 47*fcf59617SAndrey V. Elsukov.Cd "options IPSEC_SUPPORT" 48*fcf59617SAndrey V. Elsukov.Ed 49*fcf59617SAndrey V. Elsukov.Sh DESCRIPTION 50*fcf59617SAndrey V. ElsukovThe 51*fcf59617SAndrey V. Elsukov.Nm 52*fcf59617SAndrey V. Elsukovnetwork interface is targeted for creating route-based VPNs. 53*fcf59617SAndrey V. ElsukovIt can tunnel IPv4 and IPv6 traffic over either IPv4 or IPv6 and secure 54*fcf59617SAndrey V. Elsukovit with ESP. 55*fcf59617SAndrey V. Elsukov.Pp 56*fcf59617SAndrey V. Elsukov.Nm 57*fcf59617SAndrey V. Elsukovinterfaces are dynamically created and destroyed with the 58*fcf59617SAndrey V. Elsukov.Xr ifconfig 8 59*fcf59617SAndrey V. Elsukov.Cm create 60*fcf59617SAndrey V. Elsukovand 61*fcf59617SAndrey V. Elsukov.Cm destroy 62*fcf59617SAndrey V. Elsukovsubcommands. 63*fcf59617SAndrey V. ElsukovThe administrator must configure IPsec 64*fcf59617SAndrey V. Elsukov.Cm tunnel 65*fcf59617SAndrey V. Elsukovendpoint addresses. 66*fcf59617SAndrey V. ElsukovThese addresses will be used for the outer IP header of ESP packets. 67*fcf59617SAndrey V. ElsukovThe administrator can also configure the protocol and addresses for the inner 68*fcf59617SAndrey V. ElsukovIP header with 69*fcf59617SAndrey V. Elsukov.Xr ifconfig 8 , 70*fcf59617SAndrey V. Elsukovand modify the routing table to route the packets through the 71*fcf59617SAndrey V. Elsukov.Nm 72*fcf59617SAndrey V. Elsukovinterface. 73*fcf59617SAndrey V. Elsukov.Pp 74*fcf59617SAndrey V. ElsukovWhen the 75*fcf59617SAndrey V. Elsukov.Nm 76*fcf59617SAndrey V. Elsukovinterface is configured, it automatically creates special security policies. 77*fcf59617SAndrey V. ElsukovThese policies can be used to acquire security associations from the IKE daemon, 78*fcf59617SAndrey V. Elsukovwhich are needed for establishing an IPsec tunnel. 79*fcf59617SAndrey V. ElsukovIt is also possible to create needed security associations manually with the 80*fcf59617SAndrey V. Elsukov.Xr setkey 8 81*fcf59617SAndrey V. Elsukovutility. 82*fcf59617SAndrey V. Elsukov.Pp 83*fcf59617SAndrey V. ElsukovEach 84*fcf59617SAndrey V. Elsukov.Nm 85*fcf59617SAndrey V. Elsukovinterface has an additional numeric configuration option 86*fcf59617SAndrey V. Elsukov.Cm reqid Ar id . 87*fcf59617SAndrey V. ElsukovThis 88*fcf59617SAndrey V. Elsukov.Ar id 89*fcf59617SAndrey V. Elsukovis used to distinguish traffic and security policies between several 90*fcf59617SAndrey V. Elsukov.Nm 91*fcf59617SAndrey V. Elsukovinterfaces. 92*fcf59617SAndrey V. ElsukovThe 93*fcf59617SAndrey V. Elsukov.Cm reqid 94*fcf59617SAndrey V. Elsukovcan be specified on interface creation and changed later. 95*fcf59617SAndrey V. ElsukovIf not specified, it is automatically assigned. 96*fcf59617SAndrey V. ElsukovNote that changing 97*fcf59617SAndrey V. Elsukov.Cm reqid 98*fcf59617SAndrey V. Elsukovwill lead to generation of new security policies, and this 99*fcf59617SAndrey V. Elsukovmay require creating new security associations. 100*fcf59617SAndrey V. Elsukov.Sh EXAMPLES 101*fcf59617SAndrey V. ElsukovThe example below shows manual configuration of an IPsec tunnel 102*fcf59617SAndrey V. Elsukovbetween two FreeBSD hosts. 103*fcf59617SAndrey V. ElsukovHost A has the IP address 192.168.0.3, and host B has the IP address 104*fcf59617SAndrey V. Elsukov192.168.0.5. 105*fcf59617SAndrey V. Elsukov.Pp 106*fcf59617SAndrey V. ElsukovOn host A: 107*fcf59617SAndrey V. Elsukov.Bd -literal -offset indent 108*fcf59617SAndrey V. Elsukovifconfig ipsec0 create reqid 100 109*fcf59617SAndrey V. Elsukovifconfig ipsec0 inet tunnel 192.168.0.3 192.168.0.5 110*fcf59617SAndrey V. Elsukovifconfig ipsec0 inet 172.16.0.3/16 172.16.0.5 111*fcf59617SAndrey V. Elsukovsetkey -c 112*fcf59617SAndrey V. Elsukovadd 192.168.0.3 192.168.0.5 esp 10000 -m tunnel -u 100 -E rijndael-cbc "VerySecureKey!!1"; 113*fcf59617SAndrey V. Elsukovadd 192.168.0.5 192.168.0.3 esp 10001 -m tunnel -u 100 -E rijndael-cbc "VerySecureKey!!2"; 114*fcf59617SAndrey V. Elsukov^D 115*fcf59617SAndrey V. Elsukov.Ed 116*fcf59617SAndrey V. Elsukov.Pp 117*fcf59617SAndrey V. ElsukovOn host B: 118*fcf59617SAndrey V. Elsukov.Bd -literal -offset indent 119*fcf59617SAndrey V. Elsukovifconfig ipsec0 create reqid 200 120*fcf59617SAndrey V. Elsukovifconfig ipsec0 inet tunnel 192.168.0.5 192.168.0.3 121*fcf59617SAndrey V. Elsukovifconfig ipsec0 inet 172.16.0.5/16 172.16.0.3 122*fcf59617SAndrey V. Elsukovsetkey -c 123*fcf59617SAndrey V. Elsukovadd 192.168.0.3 192.168.0.5 esp 10000 -m tunnel -u 200 -E rijndael-cbc "VerySecureKey!!1"; 124*fcf59617SAndrey V. Elsukovadd 192.168.0.5 192.168.0.3 esp 10001 -m tunnel -u 200 -E rijndael-cbc "VerySecureKey!!2"; 125*fcf59617SAndrey V. Elsukov^D 126*fcf59617SAndrey V. Elsukov.Ed 127*fcf59617SAndrey V. Elsukov.Pp 128*fcf59617SAndrey V. ElsukovNote the value 100 on host A and value 200 on host B are used as reqid. 129*fcf59617SAndrey V. ElsukovThe same value must be used as identifier of the policy entry in the 130*fcf59617SAndrey V. Elsukov.Xr setkey 8 131*fcf59617SAndrey V. Elsukovcommand. 132*fcf59617SAndrey V. Elsukov.Sh SEE ALSO 133*fcf59617SAndrey V. Elsukov.Xr gif 4 , 134*fcf59617SAndrey V. Elsukov.Xr gre 4 , 135*fcf59617SAndrey V. Elsukov.Xr ipsec 4 , 136*fcf59617SAndrey V. Elsukov.Xr ifconfig 8 , 137*fcf59617SAndrey V. Elsukov.Xr setkey 8 138*fcf59617SAndrey V. Elsukov.Sh AUTHORS 139*fcf59617SAndrey V. Elsukov.An Andrey V. Elsukov Aq Mt ae@FreeBSD.org 140