---
name: "sec"
section: "4"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["openbsd"]
url: "https://new.carta.tech/sec/4"
---

# sec(4)

route based IPsec VPN tunnel interface pseudo-device

## NAME

**sec** – route based IPsec VPN tunnel interface pseudo-device

## SYNOPSIS

**pseudo-device sec**

## DESCRIPTION

The **sec** driver provides point-to-point tunnel interfaces for IPv4 and IPv6 protected by the [ipsec(4)](/ipsec/4.md) Encapsulating Security Payload (ESP) protocol.

Traffic is encapsulated in the ESP protocol and forwarded to the remote endpoint by routing over a **sec** interface rather than matching policy in the IPsec Security Policy Database (SPD). **sec** interfaces require the configuration of IPsec Security Associations (SAs) between the local and remote endpoints. Negotiation of interface SAs is supported by [iked(8)](/iked/8.md) and [isakmpd(8)](/isakmpd/8.md) (the latter via [ipsecctl(8)](/ipsecctl/8.md)).

**sec** interfaces can be created at runtime using the **ifconfig** **sec***N* **create** command or by setting up a [hostname.if(5)](/hostname.if/5.md) configuration file for [netstart(8)](/netstart/8.md). The interface itself can be configured with [ifconfig(8)](/ifconfig/8.md); see its manual page for more information.

## EXAMPLES

**sec** can be used to provide secure and confidential IP connectivity between sites over the public internet. For example, a cloud provider may provide connectivity between networks they host for a customer, and that customers own “on premises” networks using IPsec tunnels. OpenBSD can be set up on the customer side given the following parameters:

- Pre-Shared Key

  7kA7evdkd50Q5YdCCF9t8eftgEgL4vk2

Outside IP Addresses:

- Customer Gateway

  192\.0.2.8

- Provider Gateway

  198\.51.100.14

Inside IP Addresses:

- Customer Gateway

  169\.254.229.42/30

- Provider Gateway

  169\.254.229.41/30

A **sec** interface can be configured on the customer gateway:

```
# ifconfig sec0 create
# ifconfig sec0 inet 169.254.229.42/30 169.254.229.41
# ifconfig sec0 up
```

[iked(8)](/iked/8.md) can be used for IKEv2 negotiation of the IPsec tunnel with the following [iked.conf(5)](/iked.conf/5.md) configuration:

```
ikev2 "s2s" active \
	from any to any \
	local 192.0.2.8 peer 198.51.100.14 \
	psk "7kA7evdkd50Q5YdCCF9t8eftgEgL4vk2" \
	iface sec0
```

Alternatively, IKEv1 negotiation of the IPsec tunnel SAs is supported by [isakmpd(8)](/isakmpd/8.md) and [ipsecctl(8)](/ipsecctl/8.md). The equivalent [ipsec.conf(5)](/ipsec.conf/5.md) configuration for the given parameters follows:

```
ike interface sec0 \
	local 192.0.2.8 peer 198.51.100.14 \
	psk "7kA7evdkd50Q5YdCCF9t8eftgEgL4vk2"
```

Once the Security Associations are established, communication between the customer and provider gateways is enabled.

Routes to networks hosted by the provider can be added using the providers “inside IP” address as the gateway address, or negotiated using a dynamic routing protocol. Multiple **sec** interfaces may be configured to talk to separate provider gateways, providing redundancy or multiple paths between sites.

## SEE ALSO

[ipsec(4)](/ipsec/4.md), [netintro(4)](/netintro/4.md), [hostname.if(5)](/hostname.if/5.md), [pf.conf(5)](/pf.conf/5.md), [ifconfig(8)](/ifconfig/8.md), [iked(8)](/iked/8.md), [ipsecctl(8)](/ipsecctl/8.md), [isakmpd(8)](/isakmpd/8.md), [netstart(8)](/netstart/8.md)

## HISTORY

The **sec** driver first appeared in OpenBSD 7.4.

## AUTHORS

David Gwynne ⟨*dlg@openbsd.org*⟩.