IPSEC-START(8)

💖 IPSEC-START 💖

okay bestie, gather round, because this is the ipsec-start page from section 8 of the manual — the executable programs zone — and it's lowkey one of the most useful little commands in the whole ipsec family. no cap. 🫶

---

✨ NAME ✨

ipsec-start — add a connection, route it, and bring it up. like, the whole glow-up in one move. 💅

---

🌸 SYNOPSIS 🌸

ipsec start connection [--config /etc/ipsec.conf]
            [--ctlsocket /run/pluto/pluto.ctl] [--dry-run]

so the shape of it is ipsec start plus a connection, and then optionally some flags. here's the flag menu, and yes i'm keeping every single one exactly as it's written, character for character, because i respect you:

• --config /etc/ipsec.conf — takes the config file path /etc/ipsec.conf right there in the synopsis.
• --ctlsocket /run/pluto/pluto.ctl — takes the control socket path /run/pluto/pluto.ctl right there in the synopsis.
• --dry-run — the one whose whole personality gets explained in the DESCRIPTION below, bestie. keep reading. 🦋

---

🎀 DESCRIPTION 🎀

okay so first thing, two completely different moods depending on whether you hand it a connection or not.

no connection, no options? ipsec start goes and asks the initsystem to start the ipsec service. that's it. that's the whole job. she's just the messenger. 📨

with a connection? ✨ this is where it gets iconic. ipsec start connection is literally equivalent to running ipsec add connection first and then ipsec up connection second. same effect, same energy, as if you'd written the connection configuration option auto=start on startup. you get both steps in one command because you deserve nice things.

• it sets up the connection to be added to the pluto internal database, and
• it establishes the connection immediately.

no waiting around. main character energy only. 👑

⚠️ note, and this one actually matters: you might also need to run ipsec rereadsecrets when your new connection uses pre-shared key (PSK) authentication, authby=secret. the reason is that secrets keys are only being read at startup. so like, new connection + old secrets read = she doesn't know the tea yet. 🫖😭

and with --dry-run? the underlying whack or addconn command is displayed but not executed. it's the dress rehearsal, not the show. you see exactly what she would have done, and nothing actually happens. screaming, crying, perfect. 🙈

---

🌈 SEE ALSO 🌈

go read these next, i'm obsessed with all of them, fr fr:

ipsec.conf(5), ipsec(8), ipsec-add(8), ipsec-algparse(8), ipsec-briefconnectionstatus(8), ipsec-briefstatus(8), ipsec-certutil(8), ipsec-checkconfig(8), ipsec-checknflog(8), ipsec-checknss(8), ipsec-connectionstatus(8), ipsec-crlutil(8), ipsec-delete(8), ipsec-down(8), ipsec-ecdsasigkey(8), ipsec-fetchcrls(8), ipsec-fipsstatus(8), ipsec-globalstatus(8), ipsec-import(8), ipsec-initnss(8), ipsec-letsencrypt(8), ipsec-listall(8), ipsec-listcacerts(8), ipsec-listcerts(8), ipsec-listcrls(8), ipsec-listen(8), ipsec-listpubkeys(8), ipsec-modutil(8), ipsec-newhostkey(8), ipsec-ondemand(8), ipsec-pk12util(8), ipsec-pluto(8), ipsec-purgeocsp(8), ipsec-redirect(8), ipsec-replace(8), ipsec-rereadall(8), ipsec-rereadcerts(8), ipsec-rereadsecrets(8), ipsec-restart(8), ipsec-route(8), ipsec-rsasigkey(8), ipsec-setup(8), ipsec-showhostkey(8), ipsec-showroute(8), ipsec-showstates(8), ipsec-shuntstatus(8), ipsec-status(8), ipsec-stop(8), ipsec-trafficstatus(8), ipsec-unroute(8), ipsec-up(8), ipsec-vfychain(8), ipsec-whack(8)

---

💀 BUGS 💀

none. not a single one. she is flawless and we're all just living in her world. 🧚✨

---

👑 AUTHOR 👑

Andrew Cagney, Tuomo Soini — absolute icons, thank you for your service. 🫡💜

---

and that's the whole page, bestie!! this was Libreswan 5.4.1, dated 10/23/2026 — write that down, put it in your notes app, screenshot it, whatever you gotta do. now go ipsec start something and slay. 🌸💅🔥