IPSEC-_UPDOWN(8)

✨ ipsec-_updown — the routing manipulation script bestie 💅

okay so we're talking about ipsec-_updown, which lives in section 8 of the manual (it's a system admin / daemon-land thing, iykyk). It's the little script that does the routing glow-up. Let's get into it 🦋

---

🌸 NAME 🌸

ipsec-_updown — routing manipulation script. that's it, that's the job, and she ate 💖

---

✨ SYNOPSIS ✨

_updown gets invoked by pluto when it has just brought up a new connection. Like, pluto did the thing, and now it's ringing _updown's phone like "bestie come handle the routing."

_updown is invoked by pluto when it has brought up a new connection.

This script is the one that inserts the appropriate routing entries for IPsec operation on some kernel IPsec stacks. And she may also do other necessary work that is kernel or user specific — like defining custom firewall rules, no big deal 💅

The interface to the script is documented in the pluto man page. Go read that one too, bestie, it's giving ✨ required reading ✨

---

🎀 VARIABLES 🎀

_updown gets passed a whole lineup of variables, and she uses them to act differently based on the info she's been handed. It's basically a vibe check on the connection. Here's the roster, and no skipping:

• PLUTO_VERB — says the name of the operation to be performed. The options are prepare-host, prepare-client, up-host, up-client, down-host or down-client. And here's the tea: if the address family for security gateway to security gateway communications is IPv6, then a suffix of -v6 gets added to this verb. 👑
• PLUTO_CONNECTION — the name of the connection we're routing for. her name, her whole identity fr.
• PLUTO_NEXT_HOP — the next hop to which packets bound for the peer must be sent. that's where the packets are headed next 🦋
• PLUTO_INTERFACE — the name of the real interface used by encrypted traffic and IKE traffic. the actual real one, not a fake.
• PLUTO_ME — the IP address of our host. hi, that's us 💖
• PLUTO_MY_CLIENT — the IP address / count of our client subnet. And if the client is just the host, this will be the host's own IP address / max — where max is 32 for IPv4 and 128 for IPv6. literally just the host being her own client, iconic.
• PLUTO_MY_CLIENT_NET — the IP address of our client net. If the client is just the host, this will be the host's own IP address.
• PLUTO_MY_CLIENT_MASK — the mask for our client net. If the client is just the host, this will be 255.255.255.255.
• PLUTO_PEER — the IP address of our peer. the other side of the situationship 🫶
• PLUTO_PEER_CLIENT — the IP address / count of the peer's client subnet. If the client is just the peer, this will be the peer's own IP address / max — where max is 32 for IPv4 and 128 for IPv6.
• PLUTO_PEER_CLIENT_NET — the IP address of the peer's client net. If the client is just the peer, this will be the peer's own IP address.
• PLUTO_PEER_CLIENT_MASK — the mask for the peer's client net. If the client is just the peer, this will be 255.255.255.255.
• PLUTO_MY_PROTOCOL — lists the protocols allowed over this IPsec SA. all of them, listed out 🌈
• PLUTO_PEER_PROTOCOL — lists the protocols the peer allows over this IPsec SA.
• PLUTO_MY_PORT — lists the ports allowed over this IPsec SA.
• PLUTO_PEER_PORT — lists the ports the peer allows over this IPsec SA.
• PLUTO_MY_ID — lists our id. who are we? that's who 💅
• PLUTO_PEER_ID — lists our peer's id.
• PLUTO_PEER_CA — lists the peer's CA. certificate authority bestie, keeping it official 🎀
• PLUTO_DNS_RESOLVER — the name of the system's DNS resolver (file, or systemd) as configured by the ipsec.conf(5) option dns-resolver=. that's the file-or-systemd situation she's running on ✨

---

🔥 SEE ALSO 🔥

• ipsec(8)
• ipsec-pluto(8)

go read those if you want the full lore, no cap 📚

---

💜 HISTORY 💜

Man page written for the Linux FreeS/WAN project <https://www.freeswan.org/> by Michael Richardson. Original program written by Henry Spencer. the origin story is giving legacy legend energy 🌟

---

👑 AUTHOR 👑

Andrew Cagney, Antony Antony, Daniel Kahn Gillmor, Harald Jenny, Jose Quaresma, Michael Richardson, Paul Wouters, Tuomo Soini. the whole squad, and they all showed up 💖

---

and that's the whole page bestie, you're so welcome 🫶 this was Libreswan 5.4.1, dated 10/23/2026 — so go forth and route responsibly, mwah 💅✨