Index: sys/conf/config.mk
===================================================================
--- sys/conf/config.mk
+++ sys/conf/config.mk
@@ -30,6 +30,8 @@
 opt_inet6.h:
 	@echo "#define INET6 1" > ${.TARGET}
 .endif
+opt_ipsec.h:
+	@echo "#define IPSEC_SUPPORT 1" > ${.TARGET}
 .if ${MK_RATELIMIT} != "no"
 opt_ratelimit.h:
 	@echo "#define RATELIMIT 1" > ${.TARGET}
Index: sys/modules/ipsec/Makefile
===================================================================
--- sys/modules/ipsec/Makefile
+++ sys/modules/ipsec/Makefile
@@ -8,7 +8,4 @@
 	opt_inet.h opt_inet6.h opt_ipsec.h opt_sctp.h 
 SRCS.INET=	udpencap.c
 
-opt_ipsec.h:
-	@echo "#define IPSEC_SUPPORT 1" > ${.TARGET}
-
 .include <bsd.kmod.mk>
Index: sys/modules/tcp/tcpmd5/Makefile
===================================================================
--- sys/modules/tcp/tcpmd5/Makefile
+++ sys/modules/tcp/tcpmd5/Makefile
@@ -5,7 +5,4 @@
 KMOD=   tcpmd5
 SRCS=   xform_tcp.c opt_inet.h opt_inet6.h opt_ipsec.h
 
-opt_ipsec.h:
-	@echo "#define IPSEC_SUPPORT 1" > ${.TARGET}
-
 .include <bsd.kmod.mk>
Index: sys/net/if_enc.c
===================================================================
--- sys/net/if_enc.c
+++ sys/net/if_enc.c
@@ -32,6 +32,7 @@
 
 #include "opt_inet.h"
 #include "opt_inet6.h"
+#include "opt_ipsec.h"
 
 #include <sys/param.h>
 #include <sys/systm.h>
Index: sys/net/if_ipsec.c
===================================================================
--- sys/net/if_ipsec.c
+++ sys/net/if_ipsec.c
@@ -30,6 +30,7 @@
 
 #include "opt_inet.h"
 #include "opt_inet6.h"
+#include "opt_ipsec.h"
 
 #include <sys/param.h>
 #include <sys/systm.h>
Index: sys/netipsec/ipsec.h
===================================================================
--- sys/netipsec/ipsec.h
+++ sys/netipsec/ipsec.h
@@ -39,11 +39,6 @@
 #ifndef _NETIPSEC_IPSEC_H_
 #define _NETIPSEC_IPSEC_H_
 
-#if defined(_KERNEL) && !defined(_LKM) && !defined(KLD_MODULE)
-#include "opt_inet.h"
-#include "opt_ipsec.h"
-#endif
-
 #include <net/pfkeyv2.h>
 #include <netipsec/keydb.h>
 
Index: sys/netipsec/ipsec_mbuf.c
===================================================================
--- sys/netipsec/ipsec_mbuf.c
+++ sys/netipsec/ipsec_mbuf.c
@@ -32,6 +32,8 @@
  * IPsec-specific mbuf routines.
  */
 
+#include "opt_ipsec.h"
+
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/malloc.h>
Index: sys/netipsec/xform_ah.c
===================================================================
--- sys/netipsec/xform_ah.c
+++ sys/netipsec/xform_ah.c
@@ -38,6 +38,7 @@
  */
 #include "opt_inet.h"
 #include "opt_inet6.h"
+#include "opt_ipsec.h"
 
 #include <sys/param.h>
 #include <sys/systm.h>
Index: sys/netipsec/xform_esp.c
===================================================================
--- sys/netipsec/xform_esp.c
+++ sys/netipsec/xform_esp.c
@@ -37,6 +37,7 @@
  */
 #include "opt_inet.h"
 #include "opt_inet6.h"
+#include "opt_ipsec.h"
 
 #include <sys/param.h>
 #include <sys/systm.h>
Index: sys/netipsec/xform_ipcomp.c
===================================================================
--- sys/netipsec/xform_ipcomp.c
+++ sys/netipsec/xform_ipcomp.c
@@ -33,6 +33,7 @@
 /* IP payload compression protocol (IPComp), see RFC 2393 */
 #include "opt_inet.h"
 #include "opt_inet6.h"
+#include "opt_ipsec.h"
 
 #include <sys/param.h>
 #include <sys/systm.h>