_UPDOWN(8)

💅 _UPDOWN(8) — like, the whole manual, bestie

okay so real talk: this page lives in the Executable programs section of the manual, and it's called _UPDOWN(8). yes the underscore is part of the name, don't come for her. she's a script, she's iconic, she's got range. let's get into it ✨

---

🎀 NAME

ipsec__updown — kernel and routing manipulation script. that's it. that's the whole vibe. she manipulates kernels and routes and she does it flawlessly 💅

---

🌸 SYNOPSIS

_updown is invoked by pluto when it has brought up a new connection. ok so pluto is the one calling her up, like "hey bestie, connection's live, do your thing."

this script is used to insert the appropriate routing entries for IPsec operation on some kernel IPsec stacks, and may do other necessary work that is kernel or user specific, such as defining custom firewall rules. so like, she's not just a one-trick pony — she handles the routing entries on certain kernel IPsec stacks and she's flexible enough to do whatever extra kernel- or user-specific stuff you need, custom firewall rules included. main character energy fr.

the interface to the script is documented in the pluto man page. go read that one too, iykyk.

---

🦋 VARIABLES

the way that _updown gets passed a whole little entourage of variables — she can act differently based on the info she's handed. let's meet the squad 🫶

• PLUTO_VERB — specifies the name of the operation to be performed, which can be one of prepare-host, prepare-client, up-host, up-client, down-host or down-client. and listen, if the address family for security gateway to security gateway communications is IPv6, then a suffix of -v6 is added to this verb. so like, up-client-v6. slay.
• PLUTO_CONNECTION — is the name of the connection for which we are routing. the connection's actual name, girl.
• PLUTO_NEXT_HOP — is the next hop to which packets bound for the peer must be sent.
• PLUTO_INTERFACE — is the name of the real interface used by encrypted traffic and IKE traffic.
• PLUTO_ME — is the IP address of our host.
• PLUTO_MY_CLIENT — is the IP address / count of our client subnet. if the client is just the host, this will be the host's own IP address / max (where max is 32 for IPv4 and 128 for IPv6).
• PLUTO_MY_CLIENT_NET — is the IP address of our client net. if the client is just the host, this will be the host's own IP address.
• PLUTO_MY_CLIENT_MASK — is the mask for our client net. if the client is just the host, this will be 255.255.255.255. yes, the whole mask. she's committed.
• PLUTO_PEER — is the IP address of our peer.
• PLUTO_PEER_CLIENT — is the IP address / count of the peer's client subnet. if the client is just the peer, this will be the peer's own IP address / max (where max is 32 for IPv4 and 128 for IPv6).
• PLUTO_PEER_CLIENT_NET — is the IP address of the peer's client net. if the client is just the peer, this will be the peer's own IP address.
• PLUTO_PEER_CLIENT_MASK — is the mask for the peer's client net. if the client is just the peer, this will be 255.255.255.255.
• PLUTO_MY_PROTOCOL — lists the protocols allowed over this IPsec SA.
• PLUTO_PEER_PROTOCOL — lists the protocols the peer allows over this IPsec SA.
• PLUTO_MY_PORT — lists the ports allowed over this IPsec SA.
• PLUTO_PEER_PORT — lists the ports the peer allows over this IPsec SA.
• PLUTO_MY_ID — lists our id.
• PLUTO_PEER_ID — lists our peer's id.
• PLUTO_PEER_CA — lists the peer's CA.

lowkey that's a lot of variables and honestly? she handles all of them without breaking a sweat 💖

---

🔥 SEE ALSO

ipsec(8), ipsec_pluto(8). go read those, they're the lore.

---

💀 HISTORY

man page written for the Linux FreeS/WAN project <https://www.freeswan.org/> by Michael Richardson. original program written by Henry Spencer. legends, both of them 👑

---

🌈 AUTHOR

• Paul Wouters — placeholder to suppress warning. and honestly? we love a humble king. the warning has been suppressed. the vibes are immaculate 🎀

---

💜 reminder bestie: every variable name, every value, every default and every -v6 suffix up there is exactly as written — copy-paste them, don't paraphrase them. she's picky about her variable names and honestly same.

---

🌸 that's the whole page! brought to you by libreswan, dated 10/19/2026 — the manual page of all time, fr fr. ok bye now, go configure your kernel routes, you've got this 🦋✨