IPSEC-ADD(8)

📦
version 5.4.1 · 10 versions
, in fedora 43, fedora 44

💖 NAME 💖

okay so bestie, welcome to IPSEC-ADD(8) — the one and only. this page covers two lil commands: ipsec-add and ipsec-ondemand, and their whole job is adding a connection specification to pluto's internal database, straight out of /etc/ipsec.conf. yep. pluto. the IKE daemon. she's the main character here, we're just her assistants. 🫶

✨ SYNOPSIS ✨

ipsec add connection... [--auto route | up | keep] [--bg[={yes,no}] |
                        [--asynchronous[={yes,no}]]

ipsec add --autoall [--bg[={yes,no}] | [--asynchronous[={yes,no}]]

ipsec add --checkconfig

ipsec add ... [--dry-run] [-n] [--verbose] [--config /etc/ipsec.conf]
              [--ctlsocket /run/pluto/pluto.ctl]

ipsec ondemand connection... [--bg[={yes,no}] |
                             [--asynchronous[={yes,no}]]

🌸 DESCRIPTION 🌸

so like, ipsec add reads connection specs out of the config file /etc/ipsec.conf and then loads them into pluto. that's it. that's the vibe. let's break down every flavor of it:

ipsec add connection...

the connection's specification gets loaded into pluto's internal connection database, and it's configured to accept connections from remote peers (peep --auto and --autoall below 👀). big important thing: if a connection with the same name already exists in pluto's connection database, then the old connection's tunnels get torn down and the new connection specification replaces the old one. out with the old, in with the new, periodt. 💅

the option --auto specifies an extra action to take once the connection is loaded:

  • --auto=up also initiates the connection (go read ipsec-up(8))
  • --auto=route routes the connection, aka makes it on-demand (go read ipsec-route(8))

this is equivalent to a connection with auto=add being loaded during startup.

by default, once all connections are loaded, ipsec add connection... will keep monitoring pluto's logs until additional actions, such as --auto=up, have completed (--asynchronous=no). she's nosy like that, she wants to see it through. 😌

ipsec add --autoall

loads ALL the connection specifications with auto=add, auto=route, auto=up, or auto=keep. and on top of that? the auto=route connections get routed (made on-demand) and the auto=up ones get initiated. all of them. at once. slay.

by default, once all connections are loaded, ipsec add --autoall will disconnect from pluto. additional actions, such as auto=up, get performed in the background (--asynchronous=yes). she does NOT watch, she simply moves on. 🦋

ipsec add --checkconfig

parses the configuration file, doing a minimal validation pass. this will return 0 if config was valid. optionally, you can add --verbose for a more detailed analysis. it's giving "just checking on you bestie." 🎀

ipsec ondemand connection...

loads the connection and then routes it (makes it on-demand). this is equivalent to a connection with auto=route being loaded during startup.

⚠️ note: if the new connection uses pre-shared key (PSK) authentication, the command ipsec rereadsecrets may also be needed, as secrets keys are only read at startup. don't come crying to me when your PSK isn't there, i warned you 😭

wanna inspect a loaded connection? run:

ipsec connectionstatus connection

(see ipsec-connectionstatus(8)) and to remove it, run:

ipsec delete connection

(see ipsec-delete(8)).

🎀 OPTIONS 🎀

the following additional options are supported by all variants of ipsec add:

  • --dry-run, -n — do not pass the connections to pluto. just... look at them. admire them from afar. 🙈
  • --verbose — increase verbosity.
  • --config config-file — specify an alternative configuration file to load. the default is /etc/ipsec.conf.
  • --ctlsocket socket-file — specify an alternative control socket to use. the default is /run/pluto/pluto.ctl.
  • --asynchronous[={yes,no}], --bg[={yes,no}] — should ipsec add detach, allowing auto= to be performed in the background? yes or no, the choice is yours bestie.

🔥 SEE ALSO 🔥

ipsec(8), ipsec.conf(5), ipsec-delete(8) ipsec-route(8), ipsec-up(8),

💀 BUGS 💀

none

(not a single one. iconic. we ate and left no crumbs. 👑)

🌈 AUTHOR 🌈

Andrew Cagney, Tuomo Soini

so yeah, that's the whole page ✨ this was Libreswan 5.4.1, dated 10/23/2026, and that's your IPSEC-ADD(8) moment of the day. go load some connections, bestie, you've got this 💜🧚

📦 where this page comes from