NAME¶
enc —
Encapsulating Interface
SYNOPSIS¶
To compile this driver into the kernel, place the following line in your kernel
configuration file:
device enc
DESCRIPTION¶
The
enc interface is a software loopback mechanism that allows
hosts or firewalls to filter
ipsec(4) traffic using any
firewall package that hooks in via the
pfil(9) framework.
The
enc interface allows an administrator to see incoming and
outgoing packets before and after they will be or have been processed by
ipsec(4) via
tcpdump(1).
The “
enc0
” interface inherits all IPsec
traffic. Thus all IPsec traffic can be filtered based on
“
enc0
”, and all IPsec traffic could be
seen by invoking
tcpdump(1) on the
“
enc0
” interface.
What can be seen with
tcpdump(1) and what will be passed on to
the firewalls via the
pfil(9) framework can be independently
controlled using the following
sysctl(8) variables:
Name |
Defaults |
Suggested |
net.enc.out.ipsec_bpf_mask |
0x00000003 |
0x00000001 |
net.enc.out.ipsec_filter_mask |
0x00000001 |
0x00000001 |
net.enc.in.ipsec_bpf_mask |
0x00000001 |
0x00000002 |
net.enc.in.ipsec_filter_mask |
0x00000001 |
0x00000002 |
For the incoming path a value of
0x1
means
“
before stripping off the outer header
”
and
0x2
means “
after stripping
off the outer header
”. For the outgoing path
0x1
means “
with only the inner
header
” and
0x2
means
“
with outer and inner headers
”.
incoming path |------|
---- IPsec processing ---- (before) ---- (after) ----> | |
| Host |
<--- IPsec processing ---- (after) ----- (before) ---- | |
outgoing path |------|
Most people will want to run with the suggested defaults for
ipsec_filter_mask and rely on the security policy database
for the outer headers.
EXAMPLES¶
To see the packets the processed via
ipsec(4), adjust the
sysctl(8) variables according to your need and run:
tcpdump -i enc0
SEE ALSO¶
tcpdump(1),
bpf(4),
ipf(4),
ipfw(4),
ipsec(4),
pf(4),
tcpdump(8)