diff options
| author | Jacob McDonnell <jacob@jacobmcdonnell.com> | 2026-04-25 19:59:05 -0400 |
|---|---|---|
| committer | Jacob McDonnell <jacob@jacobmcdonnell.com> | 2026-04-25 19:59:05 -0400 |
| commit | 1f19f33e45791ea59aed048796fc68672c6723a5 (patch) | |
| tree | 54625fba89e91d1c2177801ec635e8528bba937f /static/netbsd/man4/ipsecif.4 3.html | |
| parent | ac5e55f5f2af5b92794c2aded46c6bae85b5f5ed (diff) | |
docs: Removed Precompiled HTML
Diffstat (limited to 'static/netbsd/man4/ipsecif.4 3.html')
| -rw-r--r-- | static/netbsd/man4/ipsecif.4 3.html | 142 |
1 files changed, 0 insertions, 142 deletions
diff --git a/static/netbsd/man4/ipsecif.4 3.html b/static/netbsd/man4/ipsecif.4 3.html deleted file mode 100644 index 1282ca44..00000000 --- a/static/netbsd/man4/ipsecif.4 3.html +++ /dev/null @@ -1,142 +0,0 @@ -<table class="head"> - <tr> - <td class="head-ltitle">IPSECIF(4)</td> - <td class="head-vol">Device Drivers Manual</td> - <td class="head-rtitle">IPSECIF(4)</td> - </tr> -</table> -<div class="manual-text"> -<section class="Sh"> -<h1 class="Sh" id="NAME"><a class="permalink" href="#NAME">NAME</a></h1> -<p class="Pp"><code class="Nm">ipsecif</code> — <span class="Nd">IPsec - interface</span></p> -</section> -<section class="Sh"> -<h1 class="Sh" id="SYNOPSIS"><a class="permalink" href="#SYNOPSIS">SYNOPSIS</a></h1> -<p class="Pp"><code class="Cd">pseudo-device ipsecif</code></p> -</section> -<section class="Sh"> -<h1 class="Sh" id="DESCRIPTION"><a class="permalink" href="#DESCRIPTION">DESCRIPTION</a></h1> -<p class="Pp">The <code class="Nm">ipsecif</code> interface is targeted for - route-based VPNs. It can tunnel IPv4 and IPv6 traffic over either IPv4 or - IPv6 and secure it with ESP.</p> -<p class="Pp"><code class="Nm">ipsecif</code> interfaces are dynamically created - and destroyed with the <a class="Xr">ifconfig(8)</a> - <code class="Cm">create</code> and <code class="Cm">destroy</code> - subcommands. The administrator must configure - <code class="Nm">ipsecif</code> tunnel endpoint addresses. These addresses - will be used for the outer IP header of ESP packets. The administrator also - configures the protocol and addresses for the inner IP header with the - <a class="Xr">ifconfig(8)</a> <code class="Cm">inet</code> or - <code class="Cm">inet6</code> subcommands, and modify the routing table to - route the packets through the <code class="Nm">ipsecif</code> interface.</p> -<p class="Pp">The packet processing is similar to <a class="Xr">gif(4)</a> over - <a class="Xr">ipsec(4)</a> transport mode, however the security policy - management is different. <a class="Xr">gif(4)</a> over - <a class="Xr">ipsec(4)</a> transport mode expects userland programs to - manage their security policies. In contrast, <code class="Nm">ipsecif</code> - manages its security policies by itself: when the administrator sets up an - <code class="Nm">ipsecif</code> tunnel source and destination address pair, - the related security policies are created automatically in the kernel. They - are automatically deleted when the tunnel is destroyed.</p> -<p class="Pp">It also means that <code class="Nm">ipsecif</code> ensures that - both the in and out security policy pairs exist, that is, - <code class="Nm">ipsecif</code> avoids the trouble caused when only one of - the in and out security policy pair exists.</p> -<p class="Pp">There are four security policies generated by - <code class="Nm">ipsecif</code>: one in and out pair for IPv4 and IPv6 each. - These security policies are equivalent to the following - <a class="Xr">ipsec.conf(5)</a> configuration where src and dst are IP - addresses specified to the tunnel:</p> -<div class="Bd Pp Bd-indent Li"> -<pre>spdadd "src" "dst" ipv4 -P out ipsec esp/transport//unique; -spdadd "dst" "src" ipv4 -P in ipsec esp/transport//unique; -spdadd "src" "dst" ipv6 -P out ipsec esp/transport//unique; -spdadd "dst" "src" ipv6 -P in ipsec esp/transport//unique;</pre> -</div> -<p class="Pp">The <code class="Nm">ipsecif</code> configuration will fail if - such security policies already exist, and vice versa.</p> -<p class="Pp">The related security associations can be established by an IKE - daemon such as <a class="Xr">racoon(8)</a>. They can also be manipulated - manually by <a class="Xr">setkey(8)</a> with the <code class="Fl">-u</code> - option which sets a security policy's unique id.</p> -<p class="Pp">Some <a class="Xr">ifconfig(8)</a> parameters change the behaviour - of <code class="Nm">ipsecif</code>. link0 can enable NAT-Traversal, link1 - can enable ECN friendly mode like <a class="Xr">gif(4)</a>, and link2 can - enable forwarding inner IPv6 packets. Only link2 is set by default. If you - use only IPv4 packets as inner packets, you would want to do</p> -<div class="Bd Pp Bd-indent Li"> -<pre>ifconfig ipsec0 -link2</pre> -</div> -<p class="Pp">to reduce security associations for IPv6 packets.</p> -</section> -<section class="Sh"> -<h1 class="Sh" id="EXAMPLES"><a class="permalink" href="#EXAMPLES">EXAMPLES</a></h1> -<p class="Pp">Configuration example:</p> -<div class="Bd Pp Li"> -<pre>Out IP addr = 172.16.100.1 Out IP addr = 172.16.200.1 -wm0 = 192.168.0.1/24 wm0 = 192.168.0.2/24 -wm1 = 10.100.0.1/24 wm1 = 10.200.0.1/24 - -+------------+ +------------+ -| NetBSD_A | | NetBSD_B | -|------------| |------------| -| [ipsec0] - - - - - - - - (tunnel) - - - - - - - - [ipsec0] | -| [wm0]------------- ... --------------[wm0] | -| | | | -+---[wm1]----+ +----[wm1]---+ - | | - | | -+------------+ +------------+ -| Host_X | | Host_Y | -+------------+ +------------+</pre> -</div> -<p class="Pp">Host_X and Host_Y will be able to communicate via an IPv4 IPsec - tunnel.</p> -<p class="Pp">On NetBSD_A:</p> -<div class="Bd Pp Li"> -<pre># ifconfig wm0 inet 192.168.0.1/24 -# ifconfig ipsec0 create -# ifconfig ipsec0 tunnel 192.168.0.1 192.168.0.2 -# ifconfig ipsec0 inet 172.16.100.1/32 172.16.200.1 -start IKE daemon or set security associations manually. -# ifconfig wm1 inet 10.100.0.1/24 -# route add 10.200.0.1 172.16.100.1</pre> -</div> -<p class="Pp">On NetBSD_B:</p> -<div class="Bd Pp Li"> -<pre># ifconfig wm0 inet 192.168.0.2/24 -# ifconfig ipsec0 create -# ifconfig ipsec0 tunnel 192.168.0.2 192.168.0.1 -# ifconfig ipsec0 inet 172.16.200.1/32 172.16.100.1 -start IKE daemon or set security associations manually. -# ifconfig wm1 inet 10.200.0.1/24 -# route add 10.100.0.1 172.16.200.1</pre> -</div> -</section> -<section class="Sh"> -<h1 class="Sh" id="SEE_ALSO"><a class="permalink" href="#SEE_ALSO">SEE - ALSO</a></h1> -<p class="Pp"><a class="Xr">gif(4)</a>, <a class="Xr">inet(4)</a>, - <a class="Xr">inet6(4)</a>, <a class="Xr">ipsec(4)</a>, - <a class="Xr">ifconfig(8)</a>, <a class="Xr">racoon(8)</a>, - <a class="Xr">setkey(8)</a></p> -</section> -<section class="Sh"> -<h1 class="Sh" id="HISTORY"><a class="permalink" href="#HISTORY">HISTORY</a></h1> -<p class="Pp">The <code class="Nm">ipsecif</code> device first appeared in - <span class="Ux">NetBSD 8.0</span>.</p> -</section> -<section class="Sh"> -<h1 class="Sh" id="LIMITATIONS"><a class="permalink" href="#LIMITATIONS">LIMITATIONS</a></h1> -<p class="Pp">Currently, the <code class="Nm">ipsecif</code> interface supports - the ESP protocol only. <code class="Nm">ipsecif</code> supports default port - number (4500) only for NAT-Traversal.</p> -</section> -</div> -<table class="foot"> - <tr> - <td class="foot-date">January 25, 2018</td> - <td class="foot-os">NetBSD 10.1</td> - </tr> -</table> |