NM-SETTINGS-LIBRESWAN(5)

💅 nm-settings-libreswan(5) — the Libreswan plugin options page, bestie edition 🎀

okay so like, this is the manual page for nm-setting-libreswan, section 5 of the File Formats Manual. It's giving "network configuration but make it VPN" and honestly? iconic. Let's get into it ✨

---

🌸 NAME 🌸

nm-setting-libreswan — the NetworkManager Libreswan plugin, and every option it supports. periodt.

---

🦋 DESCRIPTION 🦋

So NetworkManager works off this whole concept of connection profiles — basically little bundles of settings that describe your network config (peep nm-settings(5) if you're curious, it's a whole thing 💖).

The kicker is that the data and secret keys belonging to the vpn setting are literally just dictionaries of key/value pairs, and what goes in them depends on the specific VPN plugin you're using. This page right here is the full list of allowed key/value pairs for the NetworkManager Libreswan plugin. no cap, that's it 🫶

---

🧚 VPN.DATA 🧚

Okay so here's the tea: lots of the key/value pairs in the vpn.data property get passed unchanged to the Libreswan service. Before that happens, the NetworkManager plugin validates the config first, and it'll also add some extra Libreswan parameters and defaults if they're needed. Some key/value pairs are for the plugin's own config only — like the flags it uses to manage the secrets your connection needs 👑

Here's the full list of allowed parameters, no gatekeeping:

• right — contains the address of the remote VPN endpoint. Corresponds to the Libreswan parameter of the same name. Always required. (yes, always — this one's non-negotiable 💀)
• rightid — specifies the remote identifier to be used during IKE negotiation. Corresponds to the Libreswan parameter of the same name.
• rightrsasigkey — specifies the remote's public key for RSA authentication. When the leftcert key is defined, a default value of %cert is assumed.
• authby — how the two security gateways should authenticate each other. Corresponds to the Libreswan parameter of the same name.
• left — contains the local address that should be used during IKE negotiation. If not specified, the value %defaultroute is assumed. Corresponds to the Libreswan parameter of the same name.
• leftid — specifies the local identifier to be used during IKE negotiation. When this property is specified and the IKEv1 protocol is used, the key exchange will be performed in aggressive mode. Corresponds to the Libreswan parameter of the same name.
• leftrsasigkey — specifies the local public key for RSA authentication. The key should already be installed in the *swan NSS database. When the leftcert key is defined, a default value of %cert is assumed.
• leftcert — this defines the certificate nickname of your certificate in the NSS database. The certificate should already be installed in the NSS database. 📜
• leftxauthusername or leftusername — the username to be used during XAUTH authentication. If not specified, the current user will be implicitly assumed. Corresponds to the Libreswan parameter of the same name.
• dhgroup — ignored. that's it. it does nothing. move along bestie 🙈
• pfsgroup — ignored. also nothing. love that for us ✨
• dpdtimeout — the length of time that we'll idle without hearing back from our peer. After this period has elapsed with no response and no traffic, we'll declare the peer dead and remove the SA. Set the value bigger than dpddelay to enable it. If dpdtimeout is set, dpddelay also needs to be set. Must be a number optionally followed by a time unit: 's' (seconds), 'm' (minutes), 'h' (hours) or 'd' (days); if the unit is not specified, it defaults to seconds. Corresponds to the Libreswan parameter of the same name. ⏰
• dpddelay — the delay between Dead Peer Detection (IKEv1 RFC 3706) or IKEv2 Liveness keepalives that are sent for this connection. Must be a number optionally followed by a time unit: 's' (seconds), 'm' (minutes), 'h' (hours) or 'd' (days); if the unit is not specified, it defaults to seconds. Corresponds to the Libreswan parameter of the same name.
• dpdaction — when a DPD-enabled peer is declared dead, what action should be taken. "hold" (default) means the eroute will be put into %hold status, while "clear" means the eroute and SA will both be cleared. "restart" means that ALL SAs to the dead peer will be renegotiated. Corresponds to the Libreswan parameter of the same name. 🔥
• ike — allowed ciphers to be negotiated to establish the IKE SAs. Corresponds to the Libreswan parameter of the same name. Default value depends on Libreswan, but for IKEv1 aggressive negotiation: in that case the default is forced to 'aes256-sha1;modp1536'.
• esp — allowed ciphers for establishing phase2 SAs. Matches the Libreswan parameter of the same name. Default value depends on Libreswan, but for IKEv1 aggressive negotiation: in that case the default is forced to 'aes256-sha1'.
• ikelifetime — how long the phase1 SA of a connection should last. Matches the Libreswan parameter of the same name. Default value is '24h'. 🕰️
• salifetime — how long the phase2 SA of a connection should last. Matches the Libreswan parameter of the same name. Default value is '24h'.
• vendor — when it equals 'Cisco', the 'cisco-unity=yes' will be passed to Libreswan, to allow sending the CISCO_UNITY payload to the peer. The option is ignored otherwise.
• rightsubnet — the destination subnet that should be reached through the VPN. If omitted, will be filled with '::/0' when 'clientaddrfamily' is 'ipv6' or the first local subnet is IPv6, and with '0.0.0.0/0' otherwise. Set it explicitly when the local subnets mix address families, since a single default can only cover one. Matches the Libreswan parameter of the same name. 🌈
• ikev2 — use IKEv2 negotiation. Allowed values are: 'permit', 'no'/'never', 'yes'/'propose' and 'insist'. Matches the Libreswan parameter of the same name.
• narrowing — only effective in IKEv2 negotiation. Allowed values are: 'yes' and 'no'. Matches the Libreswan parameter of the same name.
• rekey — allowed values are: 'yes' and 'no'. Defaults to 'yes'. Matches the Libreswan parameter of the same name.
• fragmentation — allowed values are: 'yes' and 'no'. Matches the Libreswan parameter of the same name.
• mobike — allowed values are: 'yes' and 'no'. Matches the Libreswan parameter of the same name.
• ipsec-interface — if set, create or use an existing virtual interface ipsecXXX for "Routing based VPNs" (as opposed to "Policy based VPNs"). Valid options are 'yes', 'no' or a number. When using a number, the IPsec interface created and/or used will use that number as part of the interface name. Corresponds to the Libreswan parameter of the same name.
• pskinputmodes — where the 'pskvalue' can be retrieved. Used internally by the plugin. Allowed values are: 'unused', 'save', 'ask'.
• nm-auto-defaults — allowed values are: 'yes' and 'no'. This option indicates that the VPN plugin should not substitute default values for keys that are not present in vpn.data or alter the values for the keys that are specified. Malformed values will be rejected for security reasons, but other than that the user is responsible for ensuring the configuration will work. This is mainly useful when connections are created with a management tool like nmstatectl(8). 🔐
• nm-connect-mode — indicates the mode in which NetworkManager establishes the connection. Allowed values are: 'up' (the default) and 'ondemand'.

When set to "ondemand", it is equivalent to calling "ipsec add" and "ipsec route" on the connection. The connection configuration is loaded, allowing the remote host to connect. The necessary IPsec policy and routes are added to the system, preventing any leak of unencrypted traffic. This mode also causes the tunnel to be established when there is outgoing traffic destined for the remote network. A failure in creating the tunnel does not cause a failure of the NetworkManager connection, as this mode always keeps listening. 👀

The default value is "up", which is equivalent to calling "ipsec add" and "ipsec up"; this value instructs the Libreswan daemon to immediately attempt to establish the tunnel. If the tunnel can't be established, the activation will fail.

The allowed values are similar to those of the Libreswan "auto" property, with some differences. NetworkManager-libreswan only supports the values described above. Also, in Libreswan the "auto" property specifies what happens at daemon startup, while "nm-connect-mode" specifies what happens during an activation. 💡

• xauthpasswordinputmodes — where the 'xauthpassword' can be retrieved. Used internally by the plugin. Allowed values are: 'unused', 'save', 'ask'.
• pskvalue-flags — how to handle the 'pskvalue' secret. See the "Secret flag type" section at nm-settings(5) for details.
• xauthpassword-flags — how to handle the 'xauthpassword' secret. See the "Secret flag type" section at nm-settings(5) for details.
• leftsendcert — this option configures when Libreswan will send X.509 certificates to the remote host. Example values are: 'yes', 'always', 'no', 'never', 'sendifasked'. NetworkManager-libreswan does not validate this option but merely passes it to the Libreswan daemon. Please check the Libreswan documentation for detail. 📬
• rightca — this option specifies the authorized Certificate Authority (CA) that signed the certificate of the remote host.
• leftprotoport — this option specifies the allowed protocols and ports over connection.
• rightprotoport — this option specifies the allowed protocols and ports over connection.
• leftsubnets — this option specifies multiple private subnets behind the left participant.
• rightsubnets — this option specifies multiple private subnets behind the right participant.

---

💜 VPN.SECRETS 💜

The vpn.secrets property holds the secrets stored in the connection (if any). The allowed keys are, and yes there's only two of them, keeping it cute:

• pskvalue — if specified, its value is configured in the Libreswan secret file for the authentication of the connection. 🤫
• xauthpassword — if specified, its value is provided to Libreswan during XAUTH authentication.

---

👑 SEE ALSO 👑

NetworkManager(8), nm-settings(5) — go read those too, bestie, they're the lore 💖

---

and that's the whole page, fr fr! this drop is dated 7 Apr 2025 and it's the NM-SETTINGS-LIBRESWAN(5) girlie herself signing off 💅✨ hope your tunnels stay up and your secrets stay secret, mwah 🫶