1.\" $OpenBSD: sec.4,v 1.2 2023/08/07 16:29:36 jmc Exp $ 2.\" 3.\" Copyright (c) 2023 David Gwynne <dlg@openbsd.org> 4.\" 5.\" Permission to use, copy, modify, and distribute this software for any 6.\" purpose with or without fee is hereby granted, provided that the above 7.\" copyright notice and this permission notice appear in all copies. 8.\" 9.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16.\" 17.Dd $Mdocdate: August 7 2023 $ 18.Dt SEC 4 19.Os 20.Sh NAME 21.Nm sec 22.Nd route based IPsec VPN tunnel interface pseudo-device 23.Sh SYNOPSIS 24.Cd "pseudo-device sec" 25.Sh DESCRIPTION 26The 27.Nm 28driver provides point-to-point tunnel interfaces for IPv4 and IPv6 29protected by the 30.Xr ipsec 4 31Encapsulating Security Payload (ESP) 32protocol. 33.Pp 34Traffic is encapsulated in the ESP protocol and forwarded to the 35remote endpoint by routing over a 36.Nm 37interface rather than matching policy in the IPsec Security Policy 38Database (SPD). 39.Nm 40interfaces require the configuration of IPsec Security Associations (SAs) 41.\" with the interface extension 42between the local and remote endpoints. 43Negotiation of interface SAs is supported by 44.Xr iked 8 45and 46.Xr isakmpd 8 47(the latter via 48.Xr ipsecctl 8 ) . 49.Pp 50.Nm 51interfaces can be created at runtime using the 52.Ic ifconfig sec Ns Ar N Ic create 53command or by setting up a 54.Xr hostname.if 5 55configuration file for 56.Xr netstart 8 . 57The interface itself can be configured with 58.Xr ifconfig 8 ; 59see its manual page for more information. 60.Sh SEE ALSO 61.Xr ipsec 4 , 62.Xr netintro 4 , 63.Xr hostname.if 5 , 64.Xr pf.conf 5 , 65.Xr ifconfig 8 , 66.Xr iked 8 , 67.Xr ipsecctl 8 , 68.Xr isakmpd 8 , 69.Xr netstart 8 70.Sh HISTORY 71The 72.Nm 73driver first appeared in 74.Ox 7.4 . 75.Sh AUTHORS 76.An David Gwynne Aq Mt dlg@openbsd.org . 77