ENC(4)

💅 enc — the Encapsulating Interface 🎀

okay bestie so this is the manual page for enc from the kernel interfaces manual, and honestly? it's giving backstage-pass-to-your-own-packets energy. let's get into it ✨

---

✨ SYNOPSIS ✨

wanna bake this driver straight into your kernel? drop this line in your kernel configuration file, no cap:

device enc

or, if you'd rather load it as a module at boot time (very demure, very modular of you 🦋), put this in loader.conf(5):

if_enc_load="YES"

---

🌸 DESCRIPTION 🌸

so the enc interface is a software loopback mechanism — literally a little mirror realm for your packets 🔥 — that lets hosts or firewalls filter ipsec(4) traffic using any firewall package that hooks in via the pfil(9) framework. any of them. she's flexible like that 💅

it also lets an administrator peek at incoming and outgoing packets before and after they will be or have been processed by ipsec(4), using tcpdump(1). front row seats to the whole glow-up ✨

the enc0 interface inherits all IPsec traffic. so yeah — all IPsec traffic can be filtered based on enc0, and all IPsec traffic could be seen by just invoking tcpdump(1) on the enc0 interface. one interface, all the tea 🫖

here's the part where it gets a lil technical bestie, stay with me — what can be seen with tcpdump(1) and what will be passed on to the firewalls via the pfil(9) framework can be independently controlled using these sysctl(8) variables 👇

• net.enc.out.ipsec_bpf_mask — default 0x00000003, suggested 0x00000001
• net.enc.out.ipsec_filter_mask — default 0x00000001, suggested 0x00000001
• net.enc.in.ipsec_bpf_mask — default 0x00000001, suggested 0x00000002
• net.enc.in.ipsec_filter_mask — default 0x00000001, suggested 0x00000002

okay now the decoders 🔍 for the incoming path: a value of 0x1 means "before stripping off the outer header" and 0x2 means "after stripping off the outer header". for the outgoing path, 0x1 means "with only the inner header" and 0x2 means "with outer and inner headers". iykyk 😌

here's the whole flow, iconic diagram and all:

incoming path                                          |------|
---- IPsec processing ---- (before) ---- (after) ----> |      |
                                                       | Host |
<--- IPsec processing ---- (after) ----- (before) ---- |      |
outgoing path                                          |------|

most people will want to run with the suggested defaults for ipsec_filter_mask and rely on the security policy database for the outer headers. just let the SPD cook 🍳

⚠️ heads up bestie: packets are captured by BPF before firewall processing. the special value 0x4 can be configured in the ipsec_bpf_mask and packets will be also captured after firewall processing. two-for-one capture situation, no cap 💀

---

🦋 EXAMPLES 🦋

wanna see the packets processed via ipsec(4)? adjust the sysctl(8) variables according to your need (your need, your rules, main character energy 👑) and run:

tcpdump -i enc0

that's it. that's the whole ritual 🙈

---

🌈 SEE ALSO 🌈

• tcpdump(1)
• bpf(4)
• ipf(4)
• ipfw(4)
• ipsec(4)
• pf(4)

---

and that's the page, bestie 💖 this one came from Debian, dated August 9, 2017 — vintage but still slaying 🎀 periodt ✨