IPSEC(8)

📦
version 5.4.1 · 21 versions
, in fedora 43, fedora 44

💖 IPSEC(8) — the ipsec girlie's front door 💖

okay so real talk, this is the ipsec manual page (section 8, executable programs, iykyk) and it's basically the main character of the whole Libreswan squad. come sit with me, bestie, we're gonna get through it together 🫶

✨ SYNOPSIS ✨

ipsec command [argument...]

ipsec help

ipsec version

ipsec directory

🌸 DESCRIPTION 🌸

ipsec is like the group-chat admin of the whole IPsec encryption/authentication system — it invokes any of several utilities involved in controlling it, running the specified command with the specified argument as if it had been invoked directly. slay. lowkey the whole point is that it largely eliminates possible name collisions with other software, and it also permits some centralized services. very much giving "one friend to coordinate everyone's plans" energy 💅

  • ipsec help lists the available commands. most of them have their own manual pages, so you can go read those too ✨
  • ipsec version outputs the software version. go off, version number 👑
  • ipsec directory reports where the ipsec sub-commands are stored. the home address fr.

🎀 COMMANDS 🎀

to get a list of supported commands, use the command ipsec --help. and the full set of commands are listed below, no gatekeeping here bestie:

🦋 the daemon-control girlies

  • ipsec start
  • ipsec stop
  • ipsec restart
  • ipsec listen

used to control the pluto daemon using the host init system. supported init systems are sysv, systemd, upstart and openrc. pick your fighter 💀

see ipsec-start(8), ipsec-stop(8), ipsec-listen(8), and ipsec-restart(8).

🦋 the connection-manipulation girlies

  • ipsec add
  • ipsec up
  • ipsec start
  • ipsec route
  • ipsec unroute
  • ipsec ondemand
  • ipsec down
  • ipsec delete
  • ipsec redirect
  • ipsec replace

used to manually add, remove and manipulate connections. hands-on, artisanal, bespoke connections 🧚

see ipsec-add(8), ipsec-redirect(8), ipsec-up(8), ipsec-start(8), ipsec-route(8), ipsec-unroute(8), ipsec-ondemand(8), ipsec-down(8), ipsec-replace(8), and ipsec-delete(8).

🦋 the status/gossip girlies

  • ipsec status
  • ipsec briefstatus
  • ipsec connectionstatus
  • ipsec briefconnectionstatus
  • ipsec trafficstatus
  • ipsec shuntstatus

used to display information about connections and their current status. it's giving "spill the tea about what your tunnels are actually doing" ☕

see ipsec-status(8), ipsec-briefstatus(8), ipsec-trafficstatus(8), ipsec-connectionstatus(8), ipsec-shuntstatus(8), and ipsec-briefconnectionstatus(8).

🦋 the NSS database girlies

  • ipsec initnss
  • ipsec checknss
  • ipsec import
  • ipsec listall
  • ipsec listcerts
  • ipsec rereadsecrets
  • ipsec listpubkeys
  • ipsec rereadcerts
  • ipsec listcacerts
  • ipsec rereadall
  • ipsec rereadsecrets

(and yes, ipsec rereadsecrets is in there twice. she said it twice because she meant it 💅)

used to initialise, verify, and manipulate the NSS database that contains all the X.509 certificate information and private RSA keys. this is the vault, the archives, the locked notes app 🔐

see ipsec-initnss(8), ipsec-rereadall(8), ipsec-rereadsecrets(8), ipsec-listall(8), ipsec-checknss(8), ipsec-import(8), ipsec-rereadcerts(8), ipsec-listcerts(8), ipsec-listcacerts(8), ipsec-fips(8), ipsec-rereadsecrets(8), ipsec-listpubkeys(8), and ipsec-pk12status(8).

🦋 the CRL girlies

  • ipsec fetchcrls
  • ipsec listcrls

update and display the Certificate Revocation List. blocking and unblocking, but make it cryptography ✨

see ipsec-fetchcrls(8), and ipsec-listcrls(8).

🦋 the NSS tool-wrapper girlies

  • ipsec certutil
  • ipsec crlutil
  • ipsec modutil
  • ipsec pk12util
  • ipsec vfychain

wrappers around the NSS pk12util, modutil, certutil, and crlutil that can be used to directly manipulate Libreswan's NSS database. basically the utilities are wearing cute little Libreswan-branded jackets 🎀

see ipsec-certutil(8), ipsec-crlutil(8). ipsec-modutil(8), ipsec-pk12util(8), and ipsec-vfychain(8).

🦋 the config-validation girlies

  • ipsec checkconfig
  • ipsec readwriteconf

used to validate and dump the ipsec file (default /etc/ipsec.conf). proofreading your config before you post it, we love to see it 💖

see ipsec-checkconfig(8), and ipsec-readwriteconf(8).

🦋 the nflog girlies

  • ipsec checknflog
  • ipsec stopnflog

used to initialise and delete iptable rules for the nflog devices when specified via the nflog= or nflog-all= configuration options. yes those are the exact option spellings, don't come for me 😭

see ipsec-checknflog(8), and ipsec-stopnflog(8).

🦋 the daemon-whisperer girlies

  • ipsec whack

low-level utility for manipulating Libreswan's daemon pluto. it's the "talk directly to the daemon" button and she is powerful 🫶

see ipsec-whack(8).

  • ipsec pluto

Libreswan's daemon that implements the Internet Key Exchange protocols. the actual main character, honestly 👑

see ipsec-pluto(8).

🦋 the host-key girlies

  • ipsec showhostkey
  • ipsec newhostkey
  • ipsec ecdsasigkey
  • ipsec eddsasigkey
  • ipsec rsasigkey

generate and display raw host keys stored in the NSS database. heads up bestie: ipsec eddsasigkey is not built by default 🫠

see: ipsec-showhostkey(8), ipsec-newhostkey(8), ipsec-ecdsasigkey(8), ipsec-eddsasigkey(8), ipsec-rsasigkey(8).

🦋 the little solo icons

  • ipsec algparse — utility for displaying and verifying cryptographic proposals. see: ipsec-algparse(8).
  • ipsec showroute — utility for displaying the routing information. see: ipsec-showroute(8).
  • ipsec letsencrypt — utility for generating letsencrypt keys. see: ipsec-letsencrypt(8).
  • ipsec fipsstatus / ipsec cavp — display FIPS status and run FIPS crypto tests for CAVP complance. (that's how the original spells it, i'm just the messenger 💀) see: ipsec-fipsstatus(8), ipsec-cavp(8).

⭐ RETURN CODE ⭐

the ipsec command passes the return code of the sub-command back to the caller. clean, honest, transparent, we respect it 💜

the only exception is when ipsec pluto is used without --nofork, as it will fork into the background and the ipsec command returns success while the pluto daemon may in fact exit with an error code after the fork. so like… she said she was fine but she forked and left and she might NOT be fine 😭 check on her.

🍓 FILES 🍓

  • /usr/libexec/ipsec — usual utilities directory. the hangout spot 🌈

🌸 SEE ALSO 🌸

ipsec.conf(5), ipsec-add(8), ipsec-algparse(8), ipsec-briefconnectionstatus(8), ipsec-briefstatus(8), ipsec-certutil(8), ipsec-checkconfig(8), ipsec-checknflog(8), ipsec-checknss(8), ipsec-connectionstatus(8), ipsec-crlutil(8), ipsec-delete(8), ipsec-down(8), ipsec-ecdsasigkey(8), ipsec-fetchcrls(8), ipsec-fipsstatus(8), ipsec-globalstatus(8), ipsec-import(8), ipsec-initnss(8), ipsec-letsencrypt(8), ipsec-listall(8), ipsec-listcacerts(8), ipsec-listcerts(8), ipsec-listcrls(8), ipsec-listen(8), ipsec-listpubkeys(8), ipsec-modutil(8), ipsec-newhostkey(8), ipsec-ondemand(8), ipsec-pk12util(8), ipsec-pluto(8), ipsec-purgeocsp(8), ipsec-redirect(8), ipsec-replace(8), ipsec-rereadall(8), ipsec-rereadcerts(8), ipsec-rereadsecrets(8), ipsec-restart(8), ipsec-route(8), ipsec-rsasigkey(8), ipsec-setup(8), ipsec-showhostkey(8), ipsec-showroute(8), ipsec-showstates(8), ipsec-shuntstatus(8), ipsec-start(8), ipsec-status(8), ipsec-stop(8), ipsec-trafficstatus(8), ipsec-unroute(8), ipsec-up(8), ipsec-vfychain(8), ipsec-whack(8)

👑 AUTHOR 👑

Andrew Cagney, Daniel Kahn Gillmor, D. Hugh Redelmeier, Jose Quaresma, Michael Richardson, Paul Wouters, Tuomo Soini — absolute icons, all of them, we stan 💜

and that's the whole page bestie, no cap, every last flag and reference preserved 🫶 this iconic piece of documentation is from Libreswan 5.4.1, dated 10/23/2026 — go forth and configure responsibly, mwah 💋✨

📦 where this page comes from