IPSEC-ADDCONN(8)

📦
version 5.4.1 · 10 versions
, in fedora 43, fedora 44

💖 IPSEC-ADDCONN 💖

okay so bestie, this is a page about ipsec-addconn from the Executable programs pile. yes it's a man page. yes we're making it cute. let's go 🫶

✨ NAME ✨

ipsec-addconn — load a given policy into the pluto IKE daemon 🐶

🌸 SYNOPSIS 🌸

ipsec addconn [--config /etc/ipsec.conf]
              [--ctlsocket /run/pluto/pluto.ctl] [--verbose] [--debug]
              [--quiet] --options...

ipsec addconn connection...

ipsec addconn --configsetup [=option] [--noexport]

ipsec addconn --liststack [--noexport]

ipsec addconn --checkconfig

ipsec addconn --autoall

ipsec addconn --listadd | --listall | --listignore | --listroute |
              --liststart

ipsec addconn --name connection-name [left=address] [right=address]
              option=value...

ipsec addconn --help

👑 DESCRIPTION 👑

so ipsec addconn takes a config file (or stdin, she's flexible 💅) that's got the format of ipsec.conf, or the format of individual "conn" sections, and then uses all that info to load named connections — or literally all the connections defined in that config file — into the running libreswan pluto IKE daemon. it's giving matchmaker but for policies 💖

if you don't hand her a configuration file, she just uses the default one, no biggie. and if you don't tell her where the pluto socket is, she'll go with the default socket location. she knows the way ✨

when --autoall is specified, every connection that includes the auto= configuration option gets processed like this:

  • auto=add / auto=keep — the connection is loaded 😌
  • auto=route / auto=ondemand — the connection is loaded and routed 🛣️
  • auto=up / auto=start — the connection is loaded, routed, marked as needing to stay up, and initiated 🔥

and here's the thing: if the connection is already loaded, then she first removes it. out with the old, in with the new, periodt 💅

when one or more connections are specified, those connections are the ones that get loaded. any auto= sitting in the configuration? ignored. not today, bestie 🙈

when --configsetup is specified, the configuration file gets parsed for the config setup section and printed to your terminal in a form that's usable as a shell script 📜. these lines are prefaced with export — unless --noexport is specified. and if you pass an option, then only the value of that option gets printed. slay, so specific 💖

when --checkconfig is specified, the configuration file gets parsed and all sections get checked for correct syntax. if there's an error, info about it gets printed to the terminal. she's your proofreader and she will catch it 🔍

when --listroute or --liststart is specified, no connections are added or replaced — they're only shown 👀. this one is for verifying which connections the addcon command would act upon, without actually doing any of the acting. very look-don't-touch, very demure 🎀

when --name connection is specified, addconn constructs a connection description by parsing the rest of the command line as ipsec.conf(5) conn section key-values. the resulting connection then gets loaded into pluto. build-a-bear but it's a VPN connection 🧸

when --quiet is specified, log messages from pluto are not copied to standard output. and lowkey this one has a job: to avoid connection messages being duplicated in the logs, pluto, during startup, invokes addconn with this option. it's an internal thing, iykyk 🤫

🌈 SEE ALSO 🌈

💜 HISTORY 💜

Man page written for the Libreswan project <https://libreswan.org/> by Paul Wouters ✍️

⭐ AUTHOR ⭐

Andrew Cagney, Daniel Kahn Gillmor, Harald Jenny, Jose Quaresma, Michael Richardson, Paul Wouters, Tuomo Soini 👑

and that's the whole vibe bestie 💖 this was Libreswan 5.4.1, dated 10/23/2026, and it lives at IPSEC-ADDCONN(8) in the manual. go load some policies, you absolute icon 🦋✨

📦 where this page comes from