From owner-freebsd-pf@freebsd.org Mon Mar 20 14:08:56 2017 Return-Path: Delivered-To: freebsd-pf@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A9465D13593 for ; Mon, 20 Mar 2017 14:08:56 +0000 (UTC) (envelope-from lists@olivarim.com) Received: from smtp-sh.infomaniak.ch (smtp-sh.infomaniak.ch [128.65.195.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "*.infomaniak.ch", Issuer "StartCom Class 3 OV Server CA" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4C44BD45 for ; Mon, 20 Mar 2017 14:08:55 +0000 (UTC) (envelope-from lists@olivarim.com) Received: from smtp5.infomaniak.ch (smtp5.infomaniak.ch [83.166.132.18]) by smtp-sh.infomaniak.ch (8.14.5/8.14.5) with ESMTP id v2KE8r9E031711 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Mon, 20 Mar 2017 15:08:53 +0100 Received: from webmail.infomaniak.ch ([10.4.23.105]) (authenticated bits=0) by smtp5.infomaniak.ch (8.14.5/8.14.5) with ESMTP id v2KE8rPk020430 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Mon, 20 Mar 2017 15:08:53 +0100 Content-Transfer-Encoding: quoted-printable Date: Mon, 20 Mar 2017 15:08:33 +0100 From: "Marin Bernard" To: lists@olivarim.com, freebsd-pf@freebsd.org X-Webmail2-User: MTAwMzg Reply-To: lists@olivarim.com Subject: Re: Support for the enc(4) pseudo-interface Message-ID: <1490018913-f1619c15ef073d0f123d2a0940047986@olivarim.com> X-Mailer: Infomaniak Webmail X-Origin: Y8xgjoznB//SMiGKbu86tO+eL/TieqKX66IlzxJcW2Y MIME-Version: 1.0 X-Priority: 3 (Normal) Content-Type: text/plain; charset="iso-8859-1" X-Antivirus: Dr.Web (R) for Unix mail servers drweb plugin ver.6.0.2.8 X-Antivirus-Code: 0x100000 X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Mar 2017 14:08:56 -0000 Sorry for the noise: the webmail ate my message. Here is the full version: Hi all, I set up IPsec between several FreeBSD 11-RELEASE hosts. IKEv2 is managed by= =20 security/openiked. I use pf to filter the traffic, and the rulesets include several references= =20 to the enc0 pseudo-interface, which allow inbound traffic filtering=20 *after* IPsec decryption. So far, the whole configuration works fine. I noticed that the enc0 pseudo-interface was not shown in the output of the= =20 `ifconfig` command, whereas it is on OpenBSD. AFAIK, the GENERIC kernel=20 does not include the enc pseudo-device, since I could not fine a "device=20 enc" line in the kernel config file. The lack of such adevice would=20 explain why it is not manageable as a network interface, and why =A0 `ifconfig enc0 create` fails. Yet, it appears that pf is able to handle references to enc(4) in its ruleset= =20 even if the kernel does not support it. Is it expected behaviour? Is it=20 safe to use such a configuration on a production machine ? Thanks, Marin. 20 mars 2017 14:20 "Marin Bernard" a =E9crit: > Hi all,=20 > =20 > I've just set up IPsec between two FreeBSD 11-RELEASE hosts with=A0securit= y/openiked.=20 > =20 > =20 > _______________________________________________=20 > freebsd-pf@freebsd.org mailing list=20 > https://lists.freebsd.org/mailman/listinfo/freebsd-pf=20 > To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org"=20 > =20