ENC(4)                    OpenBSD Programmer's Manual                   ENC(4)

NAME
     enc - encapsulating interface

SYNOPSIS
     pseudo-device enc 1

DESCRIPTION
     The enc interface is a virtual interface for ipsec(4) traffic.  It allows
     packet filtering using pf(4); prior to encapsulation and after decapsula-
     tion, packets may be monitored using tcpdump(8).  Only one enc interface,
     enc0, is supported.

     Packet filtering is documented in greater detail in pf.conf(5), however
     some details relevant to filtering on the enc interface are documented
     below.

     Firstly, pf(4) is a stateful packet filter, which means it can track the
     state of a connection.  It does this automatically.  States are normally
     floating, which means they can match packets on any interface.  However
     this is a potential problem for filtering IPsec traffic: states need to
     be interface bound, to avoid permitting unencrypted traffic should the
     SAs expire and not be replaced.  Therefore all rules on the enc interface
     should explicitly set ``keep state (if-bound)''.  For example:

           pass in on enc0 proto ipencap from 192.168.3.2 to 192.168.3.1 \
                   keep state (if-bound)

     Secondly, the enc interface does not directly support bandwidth control
     via pf(4) queueing.  Instead, IPsec packets must be tagged and the tagged
     packets are assigned to queues.  ipsec.conf(5) provides an example of
     tag-based queueing and further information on packet tagging.

     Finally, the use of translation rules to map and redirect network traffic
     requires some care.  Packets destined to be IPsec processed are seen by
     the filer/translation engine twice, both before and after being IPsec
     processed.  If a packet's translated address on the way back fails to
     match an existing IPsec flow, from the translated address to the original
     source address, it will be discarded by the filter.  It is best to avoid
     this situation where possible, though a flow may be explicitly created to
     work around it.

     As noted above, tcpdump(8) may be invoked on the enc interface to see
     packets prior to encapsulation and after decapsulation.  For example:

           # tcpdump -i enc0

SEE ALSO
     ipsec(4), pf(4), ipsec.conf(5), pf.conf(5), tcpdump(8)

OpenBSD 4.1                    November 26, 2006                             1
