IPSEC_ADDCONN(8)

🎀 IPSEC_ADDCONN 🎀

okay bestie, welcome to IPSEC_ADDCONN(8) — that's section 8, the Executable programs corner of the manual, and this one is literally the little matchmaker that hands your policy over to the pluto IKE daemon 💅

---

✨ NAME ✨

ipsec_addconn — load a given policy into the pluto IKE daemon 🫶

---

📜 SYNOPSIS 📜

here's every single way you can call her, fr fr no cap:

ipsec addconn --configsetup [--rootdir dir] [--config filename]
      [--ctlbase socketfile] [--verbose] [--noexport] [--warningsfatal]

ipsec addconn --liststack [--rootdir dir] [--config filename]
      [--ctlbase socketfile] [--verbose] [--noexport] [--warningsfatal]

ipsec addconn --checkconfig [--rootdir dir] [--config filename]
      [--ctlbase socketfile] [--verbose] [--warningsfatal]

ipsec addconn --autoall [--rootdir dir] [--config filename]
      [--ctlbase socketfile] [--verbose] [--warningsfatal]

ipsec addconn [--rootdir dir] [--config filename] [--ctlbase socketfile]
      [--verbose] [--warningsfatal] name1 [name2 ..]

ipsec addconn [--listall] [--liststart] [--listroute] [--listadd]
      [--listignore] [--rootdir dir] [--config filename]
      [--ctlbase socketfile] [--verbose] [--warningsfatal]

ipsec addconn --help

so the vibes, in order: the --configsetup girlie, the --liststack girlie, the --checkconfig girlie, the --autoall girlie, the "just gimme name1 [name2 ..]" girlie, the big list-flags girlie (--listall, --liststart, --listroute, --listadd, --listignore all up in there together), and finally --help 🦋

and notice --rootdir dir, --config filename, --ctlbase socketfile, --verbose and --warningsfatal are basically invited to every single party — iconic 🌸 (they're the only ones who get --noexport as a plus-one on two of the forms, iykyk)

---

💖 DESCRIPTION 💖

okay so picture this: ipsec addconn takes a config file (or stdin, she's flexible like that 🌈) that's in the format of ipsec.conf, or the format of individual "conn" sections, and then uses all that info to load named connections — or all the connections defined in that configuration file — into the running libreswan pluto IKE daemon. she's the main character here, pluto's just receiving 💅

if you don't specify a configuration file, the default configuration file gets used. no notes. and if you don't specify a pluto socket, the default socket location gets used. also no notes ✨

when --addall is used, all connections defined in the config file get operated on. otherwise, only the connection names you actually specified are the ones affected — targeted, lowkey surgical 🎯

when addcon is run, connections that have the auto= option set to add, start or route will be loaded, routed or initiated. and listen — if a connection was already loaded or initiated, it gets replaced. not duplicated, not stacked, replaced, periodt 🔥

when --configsetup is specified, the configuration file is parsed for the config setup section and printed to your terminal, usable as a shell script 🐚. these are prefaced with export unless --noexport is specified — so --noexport is your "don't put export on it" button, got it 🙈

when --checkconfig is specified, the configuration file is parsed and all sections are checked for correct syntax. if an error is found, info about it gets printed to the terminal. she's giving detective energy 🔍

when --listroute or --liststart is specified, no connections are added or replaced — only shown 👀. this command can be used to verify which connections the addcon command would act upon, without actually performing any action. it's the vibe check before the actual thing, truly bestie behaviour 🧚

---

🦋 HISTORY 🦋

man page written for the Libreswan project <https://libreswan.org/> by Paul Wouters ✨ (yes the actual URL, go look, it's giving official 👑)

---

👑 AUTHOR 👑

• Paul Wouters — with the note "placeholder to suppress warning" next to his name, which honestly is such a mood 💀

---

and that's the whole page, bestie! this cutie came to you from libreswan, dated 10/19/2026 — go forth and --checkconfig responsibly 🍓💜