IPSEC-DOWN(8)

💖 IPSEC-DOWN 💖 (that's IPSEC-DOWN(8), from the executable programs section, bestie)

---

🌸 NAME 🌸

ipsec-down — take down every single tunnel that shares the same IPsec connection. yes, all of them. group demolition. 🧨

---

✨ SYNOPSIS ✨

ipsec down connection [--ctlsocket /run/pluto/pluto.ctl]

---

🦋 DESCRIPTION 🦋

okay so listen. ipsec down slides into pluto's DMs and says "tear down every connection matching connection in the internal configuration database." and pluto does it. immediately. no notes. 💅

but here's the iconic part — the connection definition itself stays put, so remotes can just... connect right back. it's giving "you can leave but i'm keeping your hoodie." 🫶

want it GONE gone? like permanently, no comeback era? then use ipsec delete instead. ipsec down is a nap. ipsec delete is a funeral. ⚰️

now, normally, pluto's route to a destination sticks around when you ipsec down a connection (or when connection setup fails, or when a later automatic rekeying fails — yes those count too, bestie 🔥). and that's actually a good thing, not a bug:

it lets you establish a new connection — maybe even with a totally different specification, because the route gets altered as necessary — without there being a "window" where packets could wander off somewhere else based on a more general route. no lost-packet side quests. 🚫👻

so if you want that route gone, use the ipsec unroute operation. (and fyi, ipsec delete implicitly removes it too, because of course it does 👑)

---

🔥 SEE ALSO 🔥

the whole friend group, fr fr:

• ipsec.conf(5)
• ipsec(8)
• ipsec-add(8)
• ipsec-algparse(8)
• ipsec-briefconnectionstatus(8)
• ipsec-briefstatus(8)
• ipsec-certutil(8)
• ipsec-checkconfig(8)
• ipsec-checknflog(8)
• ipsec-checknss(8)
• ipsec-connectionstatus(8)
• ipsec-crlutil(8)
• ipsec-delete(8)
• ipsec-ecdsasigkey(8)
• ipsec-fetchcrls(8)
• ipsec-fipsstatus(8)
• ipsec-globalstatus(8)
• ipsec-import(8)
• ipsec-initnss(8)
• ipsec-letsencrypt(8)
• ipsec-listall(8)
• ipsec-listcacerts(8)
• ipsec-listcerts(8)
• ipsec-listcrls(8)
• ipsec-listen(8)
• ipsec-listpubkeys(8)
• ipsec-modutil(8)
• ipsec-newhostkey(8)
• ipsec-ondemand(8)
• ipsec-pk12util(8)
• ipsec-pluto(8)
• ipsec-purgeocsp(8)
• ipsec-redirect(8)
• ipsec-replace(8)
• ipsec-rereadall(8)
• ipsec-rereadcerts(8)
• ipsec-rereadsecrets(8)
• ipsec-restart(8)
• ipsec-route(8)
• ipsec-rsasigkey(8)
• ipsec-setup(8)
• ipsec-showhostkey(8)
• ipsec-showroute(8)
• ipsec-showstates(8)
• ipsec-shuntstatus(8)
• ipsec-start(8)
• ipsec-status(8)
• ipsec-stop(8)
• ipsec-trafficstatus(8)
• ipsec-unroute(8)
• ipsec-up(8)
• ipsec-vfychain(8)
• ipsec-whack(8)

---

💀 BUGS 💀

none

that's literally it. not a single bug. the code is clean, the vibes are immaculate, we are thriving. ✨ (not me being proud of a manpage or whatever 🙈)

---

🎀 AUTHOR 🎀

Andrew Cagney, Tuomo Soini — legends, honestly. 🫶

---

and that's the whole page, bestie! this one's from Libreswan 5.4.1, dated 10/23/2026 — so go forth, ipsec down responsibly, and remember: down ≠ delete, periodt. 💖 bye!! 🦋