1*fcf59617SAndrey V. Elsukov.\" Copyright (c) 2017 Andrey V. Elsukov <ae@FreeBSD.org> 2*fcf59617SAndrey V. Elsukov.\" All rights reserved. 3*fcf59617SAndrey V. Elsukov.\" 4*fcf59617SAndrey V. Elsukov.\" Redistribution and use in source and binary forms, with or without 5*fcf59617SAndrey V. Elsukov.\" modification, are permitted provided that the following conditions 6*fcf59617SAndrey V. Elsukov.\" are met: 7*fcf59617SAndrey V. Elsukov.\" 1. Redistributions of source code must retain the above copyright 8*fcf59617SAndrey V. Elsukov.\" notice, this list of conditions and the following disclaimer. 9*fcf59617SAndrey V. Elsukov.\" 2. Redistributions in binary form must reproduce the above copyright 10*fcf59617SAndrey V. Elsukov.\" notice, this list of conditions and the following disclaimer in the 11*fcf59617SAndrey V. Elsukov.\" documentation and/or other materials provided with the distribution. 12*fcf59617SAndrey V. Elsukov.\" 13*fcf59617SAndrey V. Elsukov.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 14*fcf59617SAndrey V. Elsukov.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15*fcf59617SAndrey V. Elsukov.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16*fcf59617SAndrey V. Elsukov.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 17*fcf59617SAndrey V. Elsukov.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18*fcf59617SAndrey V. Elsukov.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19*fcf59617SAndrey V. Elsukov.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20*fcf59617SAndrey V. Elsukov.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21*fcf59617SAndrey V. Elsukov.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22*fcf59617SAndrey V. Elsukov.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23*fcf59617SAndrey V. Elsukov.\" SUCH DAMAGE. 24*fcf59617SAndrey V. Elsukov.\" 25*fcf59617SAndrey V. Elsukov.\" $FreeBSD$ 26*fcf59617SAndrey V. Elsukov.\" 27*fcf59617SAndrey V. Elsukov.Dd February 6, 2017 28*fcf59617SAndrey V. Elsukov.Dt if_ipsec 4 29*fcf59617SAndrey V. Elsukov.Os 30*fcf59617SAndrey V. Elsukov.Sh NAME 31*fcf59617SAndrey V. Elsukov.Nm if_ipsec 32*fcf59617SAndrey V. Elsukov.Nd IPsec virtual tunneling interface 33*fcf59617SAndrey V. Elsukov.Sh SYNOPSIS 34*fcf59617SAndrey V. ElsukovThe 35*fcf59617SAndrey V. Elsukov.Cm if_ipsec 36*fcf59617SAndrey V. Elsukovnetwork interface is a part of the 37*fcf59617SAndrey V. Elsukov.Fx 38*fcf59617SAndrey V. ElsukovIPsec implementation. 39*fcf59617SAndrey V. ElsukovTo compile it into the kernel, place this line in the kernel 40*fcf59617SAndrey V. Elsukovconfiguration file: 41*fcf59617SAndrey V. Elsukov.Bd -ragged -offset indent 42*fcf59617SAndrey V. Elsukov.Cd "options IPSEC" 43*fcf59617SAndrey V. Elsukov.Ed 44*fcf59617SAndrey V. Elsukov.Pp 45*fcf59617SAndrey V. ElsukovIt can also be loaded as part of the 46*fcf59617SAndrey V. Elsukov.Cm ipsec 47*fcf59617SAndrey V. Elsukovkernel module if the kernel was compiled with 48*fcf59617SAndrey V. Elsukov.Bd -ragged -offset indent 49*fcf59617SAndrey V. Elsukov.Cd "options IPSEC_SUPPORT" 50*fcf59617SAndrey V. Elsukov.Ed 51*fcf59617SAndrey V. Elsukov.Sh DESCRIPTION 52*fcf59617SAndrey V. ElsukovThe 53*fcf59617SAndrey V. Elsukov.Nm 54*fcf59617SAndrey V. Elsukovnetwork interface is targeted for creating route-based VPNs. 55*fcf59617SAndrey V. ElsukovIt can tunnel IPv4 and IPv6 traffic over either IPv4 or IPv6 and secure 56*fcf59617SAndrey V. Elsukovit with ESP. 57*fcf59617SAndrey V. Elsukov.Pp 58*fcf59617SAndrey V. Elsukov.Nm 59*fcf59617SAndrey V. Elsukovinterfaces are dynamically created and destroyed with the 60*fcf59617SAndrey V. Elsukov.Xr ifconfig 8 61*fcf59617SAndrey V. Elsukov.Cm create 62*fcf59617SAndrey V. Elsukovand 63*fcf59617SAndrey V. Elsukov.Cm destroy 64*fcf59617SAndrey V. Elsukovsubcommands. 65*fcf59617SAndrey V. ElsukovThe administrator must configure IPsec 66*fcf59617SAndrey V. Elsukov.Cm tunnel 67*fcf59617SAndrey V. Elsukovendpoint addresses. 68*fcf59617SAndrey V. ElsukovThese addresses will be used for the outer IP header of ESP packets. 69*fcf59617SAndrey V. ElsukovThe administrator can also configure the protocol and addresses for the inner 70*fcf59617SAndrey V. ElsukovIP header with 71*fcf59617SAndrey V. Elsukov.Xr ifconfig 8 , 72*fcf59617SAndrey V. Elsukovand modify the routing table to route the packets through the 73*fcf59617SAndrey V. Elsukov.Nm 74*fcf59617SAndrey V. Elsukovinterface. 75*fcf59617SAndrey V. Elsukov.Pp 76*fcf59617SAndrey V. ElsukovWhen the 77*fcf59617SAndrey V. Elsukov.Nm 78*fcf59617SAndrey V. Elsukovinterface is configured, it automatically creates special security policies. 79*fcf59617SAndrey V. ElsukovThese policies can be used to acquire security associations from the IKE daemon, 80*fcf59617SAndrey V. Elsukovwhich are needed for establishing an IPsec tunnel. 81*fcf59617SAndrey V. ElsukovIt is also possible to create needed security associations manually with the 82*fcf59617SAndrey V. Elsukov.Xr setkey 8 83*fcf59617SAndrey V. Elsukovutility. 84*fcf59617SAndrey V. Elsukov.Pp 85*fcf59617SAndrey V. ElsukovEach 86*fcf59617SAndrey V. Elsukov.Nm 87*fcf59617SAndrey V. Elsukovinterface has an additional numeric configuration option 88*fcf59617SAndrey V. Elsukov.Cm reqid Ar id . 89*fcf59617SAndrey V. ElsukovThis 90*fcf59617SAndrey V. Elsukov.Ar id 91*fcf59617SAndrey V. Elsukovis used to distinguish traffic and security policies between several 92*fcf59617SAndrey V. Elsukov.Nm 93*fcf59617SAndrey V. Elsukovinterfaces. 94*fcf59617SAndrey V. ElsukovThe 95*fcf59617SAndrey V. Elsukov.Cm reqid 96*fcf59617SAndrey V. Elsukovcan be specified on interface creation and changed later. 97*fcf59617SAndrey V. ElsukovIf not specified, it is automatically assigned. 98*fcf59617SAndrey V. ElsukovNote that changing 99*fcf59617SAndrey V. Elsukov.Cm reqid 100*fcf59617SAndrey V. Elsukovwill lead to generation of new security policies, and this 101*fcf59617SAndrey V. Elsukovmay require creating new security associations. 102*fcf59617SAndrey V. Elsukov.Sh EXAMPLES 103*fcf59617SAndrey V. ElsukovThe example below shows manual configuration of an IPsec tunnel 104*fcf59617SAndrey V. Elsukovbetween two FreeBSD hosts. 105*fcf59617SAndrey V. ElsukovHost A has the IP address 192.168.0.3, and host B has the IP address 106*fcf59617SAndrey V. Elsukov192.168.0.5. 107*fcf59617SAndrey V. Elsukov.Pp 108*fcf59617SAndrey V. ElsukovOn host A: 109*fcf59617SAndrey V. Elsukov.Bd -literal -offset indent 110*fcf59617SAndrey V. Elsukovifconfig ipsec0 create reqid 100 111*fcf59617SAndrey V. Elsukovifconfig ipsec0 inet tunnel 192.168.0.3 192.168.0.5 112*fcf59617SAndrey V. Elsukovifconfig ipsec0 inet 172.16.0.3/16 172.16.0.5 113*fcf59617SAndrey V. Elsukovsetkey -c 114*fcf59617SAndrey V. Elsukovadd 192.168.0.3 192.168.0.5 esp 10000 -m tunnel -u 100 -E rijndael-cbc "VerySecureKey!!1"; 115*fcf59617SAndrey V. Elsukovadd 192.168.0.5 192.168.0.3 esp 10001 -m tunnel -u 100 -E rijndael-cbc "VerySecureKey!!2"; 116*fcf59617SAndrey V. Elsukov^D 117*fcf59617SAndrey V. Elsukov.Ed 118*fcf59617SAndrey V. Elsukov.Pp 119*fcf59617SAndrey V. ElsukovOn host B: 120*fcf59617SAndrey V. Elsukov.Bd -literal -offset indent 121*fcf59617SAndrey V. Elsukovifconfig ipsec0 create reqid 200 122*fcf59617SAndrey V. Elsukovifconfig ipsec0 inet tunnel 192.168.0.5 192.168.0.3 123*fcf59617SAndrey V. Elsukovifconfig ipsec0 inet 172.16.0.5/16 172.16.0.3 124*fcf59617SAndrey V. Elsukovsetkey -c 125*fcf59617SAndrey V. Elsukovadd 192.168.0.3 192.168.0.5 esp 10000 -m tunnel -u 200 -E rijndael-cbc "VerySecureKey!!1"; 126*fcf59617SAndrey V. Elsukovadd 192.168.0.5 192.168.0.3 esp 10001 -m tunnel -u 200 -E rijndael-cbc "VerySecureKey!!2"; 127*fcf59617SAndrey V. Elsukov^D 128*fcf59617SAndrey V. Elsukov.Ed 129*fcf59617SAndrey V. Elsukov.Pp 130*fcf59617SAndrey V. ElsukovNote the value 100 on host A and value 200 on host B are used as reqid. 131*fcf59617SAndrey V. ElsukovThe same value must be used as identifier of the policy entry in the 132*fcf59617SAndrey V. Elsukov.Xr setkey 8 133*fcf59617SAndrey V. Elsukovcommand. 134*fcf59617SAndrey V. Elsukov.Sh SEE ALSO 135*fcf59617SAndrey V. Elsukov.Xr gif 4 , 136*fcf59617SAndrey V. Elsukov.Xr gre 4 , 137*fcf59617SAndrey V. Elsukov.Xr ipsec 4 , 138*fcf59617SAndrey V. Elsukov.Xr ifconfig 8 , 139*fcf59617SAndrey V. Elsukov.Xr setkey 8 140*fcf59617SAndrey V. Elsukov.Sh AUTHORS 141*fcf59617SAndrey V. Elsukov.An Andrey V. Elsukov Aq Mt ae@FreeBSD.org 142